Co-Development of Compiler and Fuzzer

Every published compiler fuzzer faces the oracle problem: how to determine whether the compiler’s response to a generated input is correct. Existing solutions require multiple compiler implementations (differential testing), semantics-preserving transformations (metamorphic testing), manually curated environment models, or custom constraint solvers. We present a fundamentally different oracle: the compiler’s own resolved symbol table. By co-developing compiler and fuzzer simultaneously, the fuzzer can compile known-valid programs through the compiler’s semantic analysis phases, harvest the resolved types, methods, operators, and constructors, and use this information to generate probe programs that exercise real symbols with type-correct signatures. Pre-curated correct/incorrect code pairs with expected error codes enable contrastive validation, detecting a new defect class — diagnostic quality bugs, where the compiler correctly rejects a program but produces the wrong error code — that crash-based and coverage-based fuzzers cannot detect.