🤖 AI Summary
This study addresses the proliferation of invalid reports in deep learning compiler fuzzing caused by repeatedly triggering known bugs. To this end, we propose Reprise, a tool that departs from traditional post-hoc deduplication paradigms by distilling known bugs into semantic graph patterns and proactively avoiding their trigger points during test case synthesis for source-level deduplication. Leveraging a unified intermediate representation and local operator signatures, Reprise employs a lightweight generator guided by semantic graph pattern matching to steer graph synthesis, thereby suppressing redundant bug triggers prior to compilation. Experimental results demonstrate that Reprise reduces crash reports by 90.2% and 93.8% for TVM and Inductor, respectively, while maintaining code coverage and uncovering 25 previously unknown bugs.
📝 Abstract
Fuzzing is effective at finding bugs in deep learning (DL) compilers, but existing fuzzers repeatedly trigger faults they have already uncovered. Current fuzzers diversify the generated programs, and downstream tools deduplicate bug reports post hoc, but neither stops a fuzzer from generating programs that re-trigger known defects. We present Reprise, a DL compiler fuzzer that suppresses reports of known defects during test generation. Reprise uses a deliberately lightweight generator that builds graphs in a unified intermediate representation (UIR) with local operator signatures. Instead of diversifying programs, Reprise distills each discovered defect into a semantic graph pattern that captures the operators, value constraints, graph context, and data flow required to trigger it. During graph synthesis, it regenerates any node that completes a known pattern, so known defect triggers are avoided before compilation and execution. We evaluate Reprise on three DL compilers: TVM, PyTorch Inductor, and ONNX Runtime. Against its unguided variant, patterns written for the dominant known defects reduce crash reports by 90.2% on TVM (254 to 25) and by 93.8% on PyTorch Inductor (594 to 37), with comparable branch coverage and 1.0-17.9% fewer executed tests. These results come from one run per configuration and concern the defects the patterns were distilled from. Reprise also found 25 previously unknown bugs across the three compilers, 24 of them within one month, of which 7 have been fixed and 12 more confirmed by developers. The replication package has been provided at [11].