TraitFuzzer is a tool for systematically validating Rust compilers. It introduces a validation approach based on the Trait-Type Constraint Graph (TTCG). TTCG captures relationships between types and traits and enables derivation of the Trait Constraint Space (TCS) for mutation. Guided by TTCG, TraitFuzzer rewrites ordinary seeds into trait-dense variants and performs both trait-constraint mutation and cross-feature mutation to drive compilers into deeper trait-solving logic. In practice, TraitFuzzer has uncovered 45 confirmed compiler bugs, including 36 in rustc and 9 in gccrs, with 9 already fixed. It also outperforms existing baselines in bug-finding ability and coverage.
- Enter the runnable project directory.
cd TraitFuzzer- Install Rust toolchains (stable + nightly).
curl https://sh.rustup.rs -sSf | sh
source "$HOME/.cargo/env"
rustup toolchain install stable nightly
rustup default stable- Download Rust UI test suite into a local seeds directory.
git clone --depth 1 https://github.com/rust-lang/rust.git
mkdir -p seeds/rust_ui
cp -r rust/tests/ui/* seeds/rust_ui/- Enable LLM-based seed rewriting. Install Ollama: https://ollama.com/download Model page: https://ollama.com/library/qwen2.5-coder
ollama pull qwen2.5-coder:14b
printf '1\n' | ./run_agent.sh- Run fuzzing.
printf '1\n' | ./start.sh- Stop services (recommended when finished).
# Stop Traitor_Agent runner + ollama
printf '2\n' | ./run_agent.sh
# Stop fuzzer main.py (+ choose no for extra cleanup prompts)
printf '2\n0\n0\n' | ./start.sh| Compiler | Type | Bug Link | Status |
|---|---|---|---|
| rustc | ICE | rust-lang/rust#151069 | confirmed |
| rustc | ICE | rust-lang/rust#151477 | fixed |
| rustc | ICE | rust-lang/rust#151894 | confirmed |
| rustc | ICE | rust-lang/rust#151964 | confirmed |
| rustc | ICE | rust-lang/rust#152295 | confirmed |
| rustc | ICE | rust-lang/rust#152405 | confirmed |
| rustc | ICE | rust-lang/rust#153195 | duplicate |
| rustc | ICE | rust-lang/rust#153241 | confirmed |
| rustc | ICE | rust-lang/rust#150751 | duplicate |
| rustc | ICE | rust-lang/rust#150753 | duplicate |
| rustc | ICE | rust-lang/rust#150770 | duplicate |
| rustc | ICE | rust-lang/rust#150854 | duplicate |
| rustc | ICE | rust-lang/rust#151579 | fixed |
| rustc | ICE | rust-lang/rust#154568 | confirmed |
| rustc | ICE | rust-lang/rust#154533 | confirmed |
| rustc | ICE | rust-lang/rust#151631 | fixed |
| rustc | ICE | rust-lang/rust#153163 | fixed |
| rustc | ICE | rust-lang/rust#153842 | fixed |
| rustc | ICE | rust-lang/rust#152205 | fixed |
| rustc | ICE | rust-lang/rust#154403 | fixed |
| rustc | ICE | rust-lang/rust#154073 | duplicate |
| rustc | ICE | rust-lang/rust#153912 | fixed |
| rustc | ICE | rust-lang/rust#150954 | duplicate |
| rustc | ICE | rust-lang/rust#154367 | fixed |
| rustc | Hang | rust-lang/rust#150583 | confirmed |
| rustc | Hang | rust-lang/rust#150794 | confirmed |
| rustc | Hang | rust-lang/rust#150858 | confirmed |
| rustc | Hang | rust-lang/rust#150989 | confirmed |
| rustc | Hang | rust-lang/rust#151503 | confirmed |
| rustc | Hang | rust-lang/rust#151599 | confirmed |
| rustc | Hang | rust-lang/rust#151671 | confirmed |
| rustc | Hang | rust-lang/rust#151723 | confirmed |
| rustc | Hang | rust-lang/rust#150532 | duplicate |
| rustc | Hang | rust-lang/rust#151632 | confirmed |
| rustc | Hang | rust-lang/rust#151961 | confirmed |
| rustc | Hang | rust-lang/rust#152169 | confirmed |
| rustc | Hang | rust-lang/rust#151636 | confirmed |
| Compiler | Type | Bug Link | Status |
|---|---|---|---|
| gccrs | ICE | Rust-GCC/gccrs#4469 | confirmed |
| gccrs | ICE | Rust-GCC/gccrs#4470 | confirmed |
| gccrs | ICE | Rust-GCC/gccrs#4471 | fixed |
| gccrs | ICE | Rust-GCC/gccrs#4472 | confirmed |
| gccrs | ICE | Rust-GCC/gccrs#4473 | confirmed |
| gccrs | ICE | Rust-GCC/gccrs#4481 | fixed |
| gccrs | ICE | Rust-GCC/gccrs#4486 | fixed |
| gccrs | ICE | Rust-GCC/gccrs#4496 | confirmed |
| gccrs | Hang | Rust-GCC/gccrs#4493 | confirmed |
TraitFuzzer is presented in the following paper:
Validating Rust Compilers with Trait-Type Constraint Graph
Xin Lai, Ming Wen, Xiaofei Liao, and Hai Jin
Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles (SOSP '26), 2026.
If you use TraitFuzzer in your research, please cite our paper:
@inproceedings{lai2026traitfuzzer,
author = {Lai, Xin and Wen, Ming and Liao, Xiaofei and Jin, Hai},
title = {Validating {Rust} Compilers with {Trait-Type Constraint Graph}},
booktitle = {Proceedings of the ACM SIGOPS 32nd Symposium on Operating Systems Principles},
year = {2026},
publisher = {ACM},
doi = {10.1145/3830418.3843907},
url = {https://doi.org/10.1145/3830418.3843907}
}