2 months ago
- Author builds a fuzzer to automatically find correctness bugs in a toy compiler optimizer.
- Random programs are generated using loads, stores, and escapes on three arguments.
- Verification invariant: optimized and unoptimized programs must produce identical heaps under non-aliasing and full-aliasing conditions.
- The fuzzer quickly catches a bug when a key optimization (removing aliasing writes) is disabled.
- Limitations include no handling of partial aliasing and the need for a more sophisticated equivalence definition for allocation removal.