DESIL: Detecting Silent Bugs in MLIR Compiler Infrastructure

MLIR (Multi-Level Intermediate Representation) compiler infrastructure provides an efficient framework for introducing a new abstraction level for programming languages and domain-specific languages. It has attracted widespread attention in recent years and has been applied in various domains, such as deep learning compiler construction. Recently, several MLIR compiler fuzzing techniques, such as MLIRSmith and MLIRod, have been proposed. However, none of them can detect silent bugs, i.e., bugs that incorrectly optimize code silently. The difficulty in detecting silent bugs arises from two main aspects: (1) UB-Free Program Generation: Ensures the generated programs are free from undefined behaviors to suit the non-UB assumptions required by compiler optimizations. (2) Lowering Support: Converts the given MLIR program into an executable form, enabling execution result comparisons, and selects a suitable lowering path for the program to reduce redundant lowering pass and improve the efficiency of fuzzing. To address the above issues, we propose DESIL. DESIL enables silent bug detection by defining a set of UB-elimination rules based on the MLIR documentation and applying them to input programs to produce UB-free MLIR programs. To convert dialects in MLIR program into the executable form, DESIL designs a lowering path optimization strategy to convert the dialects in given MLIR program into executable form. Furthermore, DESIL incorporates the differential testing for silent bug detection. To achieve this, it introduces an operation-aware optimization recommendation strategy into the compilation process to generate diverse executable files. We applied DESIL to the latest revisions of the MLIR compiler infrastructure. It detected 23 silent bugs and 19 crash bugs, of which 12/14 have been confirmed or fixed