A slightly more approachable introduction to EMI-based testing: http://blog.regehr.org/archives/1161
(Found while googling around for the actual Orion tool mentioned in the EMI papers.)
Very neat ideas. As the regehr.org article points out, it's particularly impressive that 110 of the 147 found compiler bugs were actually fixed.
My summary of how it works:
Take a test program, take an input to the program, trace the program execution on the input.
This results in a set of 'dead' (unexecuted) code for the given program and input. At this point you can start randomly perturbing (deleting parts of etc..) the dead code. If the program output changes, you have a compiler bug.
Seems like a nice technique. The only problem in my mind is the need for coverage/execution tracing that may not be readily available.
It's amazing how many bugs compilers like gcc _still_ have. Mind these are C compilers: I don't even dare to think what the status is for C++ compilers.
Very neat ideas. As the regehr.org article points out, it's particularly impressive that 110 of the 147 found compiler bugs were actually fixed.