Draft Testing section

paper/bibliography.bib

@@ -168,3 +168,82 @@ keywords = {data structures, searching, trees}
    author={Lemire, Daniel and Kaser, Owen and Kurz, Nathan and Deri, Luca and O’Hara, Chris and Saint‐Jacques, François and Ssi‐Yan‐Kai, Gregory},
    year={2018},
    month=jan, pages={867–895} }
+
+@misc{libfuzzer,
+  title = {libFuzzer – a library for coverage-guided fuzz testing},
+  howpublished = {\url{https://llvm.org/docs/LibFuzzer.html}},
+  note = {Accessed: 2024-04-19}
+}
+
+@misc{ubsan,
+  title = {Undefined Behaviort Sanitizer},
+  howpublished = {\url{https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html}},
+  note = {Accessed: 2024-04-19}
+}
+
+
+@inproceedings{10.5555/2342821.2342849,
+author = {Serebryany, Konstantin and Bruening, Derek and Potapenko, Alexander and Vyukov, Dmitry},
+title = {AddressSanitizer: a fast address sanity checker},
+year = {2012},
+publisher = {USENIX Association},
+address = {USA},
+abstract = {Memory access bugs, including buffer overflows and uses of freed heap memory, remain a serious problem for programming languages like C and C++. Many memory error detectors exist, but most of them are either slow or detect a limited set of bugs, or both.This paper presents AddressSanitizer, a new memory error detector. Our tool finds out-of-bounds accesses to heap, stack, and global objects, as well as use-after-free bugs. It employs a specialized memory allocator and code instrumentation that is simple enough to be implemented in any compiler, binary translation system, or even in hardware.AddressSanitizer achieves efficiency without sacrificing comprehensiveness. Its average slowdown is just 73\% yet it accurately detects bugs at the point of occurrence. It has found over 300 previously unknown bugs in the Chromium browser and many bugs in other software.},
+booktitle = {Proceedings of the 2012 USENIX Conference on Annual Technical Conference},
+pages = {28},
+numpages = {1},
+location = {Boston, MA},
+series = {USENIX ATC'12}
+}
+@inproceedings{10.1145/1791194.1791203,
+author = {Serebryany, Konstantin and Iskhodzhanov, Timur},
+title = {ThreadSanitizer: data race detection in practice},
+year = {2009},
+isbn = {9781605587936},
+publisher = {Association for Computing Machinery},
+address = {New York, NY, USA},
+url = {https://doi.org/10.1145/1791194.1791203},
+doi = {10.1145/1791194.1791203},
+abstract = {Data races are a particularly unpleasant kind of threading bugs. They are hard to find and reproduce -- you may not observe a bug during the entire testing cycle and will only see it in production as rare unexplainable failures. This paper presents ThreadSanitizer -- a dynamic detector of data races. We describe the hybrid algorithm (based on happens-before and locksets) used in the detector. We introduce what we call dynamic annotations -- a sort of race detection API that allows a user to inform the detector about any tricky synchronization in the user program. Various practical aspects of using ThreadSanitizer for testing multithreaded C++ code at Google are also discussed.},
+booktitle = {Proceedings of the Workshop on Binary Instrumentation and Applications},
+pages = {62–71},
+numpages = {10},
+keywords = {Valgrind, concurrency bugs, dynamic data race detection, testing},
+location = {New York, New York, USA},
+series = {WBIA '09}
+}
+
+@article{10.1145/3591257,
+author = {Isemann, Raphael and Giuffrida, Cristiano and Bos, Herbert and van der Kouwe, Erik and Gleissenthall, Klaus von},
+title = {Don’t Look UB: Exposing Sanitizer-Eliding Compiler Optimizations},
+year = {2023},
+issue_date = {June 2023},
+publisher = {Association for Computing Machinery},
+address = {New York, NY, USA},
+volume = {7},
+number = {PLDI},
+url = {https://doi.org/10.1145/3591257},
+doi = {10.1145/3591257},
+abstract = {Sanitizers are widely used compiler features that detect undefined behavior and resulting vulnerabilities by injecting runtime checks into programs. For better performance, sanitizers are often used in conjunction with optimization passes. But doing so combines two compiler features with conflicting objectives. While sanitizers want to expose undefined behavior, optimizers often exploit these same properties for performance. In this paper, we show that this clash can have serious consequences: optimizations can remove sanitizer failures, thereby hiding the presence of bugs or even introducing new ones.  
+
+We present LookUB, a differential-testing based framework for finding optimizer transformations that elide sanitizer failures. We used our method to find 17 such sanitizer-eliding optimizations in Clang. Next, we used static analysis and fuzzing to search for bugs in open-source projects that were previously hidden due to sanitizer-eliding optimizations. This led us to discover 20 new bugs in Linux Containers, libmpeg2, NTFS-3G, and WINE. Finally, we present an effective mitigation strategy based on a customization of the Clang optimizer with an overhead increase of 4\%.},
+journal = {Proc. ACM Program. Lang.},
+month = {jun},
+articleno = {143},
+numpages = {21},
+keywords = {Sanitizers, Optimizations, Fuzzing}
+}
+
+@inproceedings{10.5555/1247360.1247362,
+author = {Seward, Julian and Nethercote, Nicholas},
+title = {Using Valgrind to detect undefined value errors with bit-precision},
+year = {2005},
+publisher = {USENIX Association},
+address = {USA},
+abstract = {We present Memcheck, a tool that has been implemented with the dynamic binary instrumentation framework Valgrind. Memcheck detects a wide range of memory errors in programs as they run. This paper focuses on one kind of error that Memcheck detects: undefined value errors. Such errors are common, and often cause bugs that are hard to find in programs written in languages such as C, C++ and Fortran. Memcheck's definedness checking improves on that of previous tools by being accurate to the level of individual bits. This accuracy gives Memcheck a low false positive and false negative rate.The definedness checking involves shadowing every bit of data in registers and memory with a second bit that indicates if the bit has a defined value. Every value-creating operation is instrumented with a shadow operation that propagates shadow bits appropriately. Memcheck uses these shadow bits to detect uses of undefined values that could adversely affect a program's behaviour.Under Memcheck, programs typically run 20-30 times slower than normal. This is fast enough to use with large programs. Memcheck finds many errors in real programs, and has been used during the past two years by thousands of programmers on a wide range of systems, including OpenOffice, Mozilla, Opera, KDE, GNOME, MySQL, Perl, Samba, The GIMP, and Unreal Tournament.},
+booktitle = {Proceedings of the Annual Conference on USENIX Annual Technical Conference},
+pages = {2},
+numpages = {1},
+location = {Anaheim, CA},
+series = {ATEC '05}
+}