An Empirical Study of Rust-Specific Bugs in the rustc Compiler
Zixi Liu, Yang Feng, Yunbo Ni, Shaohua Li, Xizhe Yin, Qingkai Shi, Baowen Xu, Zhendong Su
TL;DR
This paper tackles the problem of Rust-specific compiler bugs in rustc by conducting a large-scale, three-year empirical study of 301 valid rustc bugs and their fixes. It systematically labels bug causes, symptoms, and the compilation stages involved, and evaluates existing rustc testing tools through a 12-hour, cross-tool evaluation on a common rustc version. The key contributions include a detailed taxonomy of bug causes (notably Type System and Ownership/Lifetime), a map of bug-prone stages (primarily HIR and MIR), and insights into test-case characteristics and tool shortcomings, such as limited detection of non-crash bugs. The findings highlight the need for stronger Rust-aware testing techniques and targeted improvements in rustc’s HIR/MIR verification and diagnostic reporting to enhance reliability in Rust’s safety-critical domains.
Abstract
Rust is gaining popularity for its well-known memory safety guarantees and high performance, distinguishing it from C/C++ and JVM-based languages. Its compiler, rustc, enforces these guarantees through specialized mechanisms such as trait solving, borrow checking, and specific optimizations. However, Rust's unique language mechanisms introduce complexity to its compiler, leading to Rust-specific compiler bugs that are less common in traditional compilers. With Rust's increasing adoption in safety-critical domains, understanding these language mechanisms and their impact on compiler bugs is essential for improving the reliability of both rustc and Rust programs. Yet, we still lack a large-scale, detailed, and in-depth study of Rust-specific bugs in rustc. To bridge this gap, this work conducts a comprehensive and systematic study of Rust-specific bugs in rustc, with a particular focus on the components that support its unique language features. Our analysis examines issues and fixes reported between 2022 and 2024, with a manual review of 301 valid issues. We categorize these bugs based on their causes, symptoms, affected compilation stages, and test case characteristics. Additionally, we evaluate existing rustc testing tools to assess their effectiveness and limitations. Our key findings include: (1) rustc bugs primarily arise from Rust's type system and lifetime model, with frequent errors in the High-Level Intermediate Representation (HIR) and Mid-Level Intermediate Representation (MIR) modules due to complex checkers and optimizations; (2) bug-revealing test cases often involve unstable features, advanced trait usages, lifetime annotations, standard APIs, and specific optimization levels; (3) while both valid and invalid programs can trigger bugs, existing testing tools struggle to detect non-crash errors, underscoring the need for further advancements in rustc testing.