arXiv subjects

Nick Sumner

Publications and source records attributed to Nick Sumner.

4 recordsLinked to original sources

arXiv2026

Leaf: An Instrumentation-based Dynamic Analysis Framework for Rust

This paper presents LEAF, an instrumentation-based dynamic analysis framework for Rust. Although Rust has grown rapidly in recent years, the landscape of program analysis tools for Rust is still in relatively early stages. One notable gap is the lack of a general-purpose dynamic analysis framework that can support different analysis tasks. LEAF aims to fill this gap by providing a Rust-native framework for analyzing Rust programs at runtime. Rust provides rich semantic information through its ownership model, type system, memory model, and compiler-level representation. Therefore, LEAF focuses on how to make this information available to dynamic analyses. In particular, LEAF captures MIR-level semantic information, augments it with runtime facts, and delivers it to analyses as an event stream through Dynamic MIR (DMIR), an event-driven programming interface. Through three substantial dynamic analyses -- a concolic executor, a Rust-specific sanitizer, and a control-flow tracer -- we demonstrate the practicality and expressiveness of LEAF. Our evaluation further shows that LEAF's compile-time and runtime overhead is meaningful but manageable.

cs.SE↗

arXiv2026

RustMizan: A Compilable, Contamination-Aware Benchmarking Framework for Rust Vulnerabilities

LLM agents are increasingly applied to vulnerability analysis, but existing benchmarks have not kept pace. They typically rely on small non-compilable snippets, focus on binary classification (vulnerable or not), and do not account for the risk that publicly-released datasets are part of model training corpora. We introduce RustMizan, a benchmarking framework for Rust vulnerability analysis that addresses these gaps. RustMizan contains compilable code variants at the crate, file, and function levels, with annotations for binary vulnerability detection, CWE classification, and function- and line-level localization. A paired mutation framework produces semantics-preserving code mutants for contamination testing and robustness probing. Across four frontier models in an agentic setup with command-line access, binary classification sits in the 56-65% range, but line localization F1 stays near 20%, and adversarial cues drop line F1 by about 27%.

cs.CR↗

arXiv2026

From Logic to Toolchains: An Empirical Study of Bugs in the TypeScript Ecosystem

TypeScript has rapidly become a popular language for modern web development, yet its effect on software faults remains poorly understood. This paper presents the first large-scale empirical study of bugs in real-world TypeScript projects. We analyze 633 bug reports from 16 popular open-source repositories to construct a taxonomy of fault types, quantify their prevalence, and relate them to project characteristics such as size, domain, and dependency composition. Our results reveal a fault landscape dominated not by logic or syntax errors but by tooling and configuration faults, API misuses, and asynchronous error-handling issues. We show that these categories correlate strongly with build complexity and dependency heterogeneity, indicating that modern failures often arise at integration and orchestration boundaries rather than within algorithmic logic. A longitudinal comparison with JavaScript studies shows that while static typing in TypeScript has reduced traditional runtime and type errors, it has shifted fragility toward build systems and toolchains. These findings offer new insight into how language design and ecosystem evolution reshape the fault profiles of large-scale software systems.

cs.SE↗

arXiv2021

Leveraging Models to Reduce Test Cases in Software Repositories

Given a failing test case, test case reduction yields a smaller test case that reproduces the failure. This process can be time consuming due to repeated trial and error with smaller test cases. Current techniques speed up reduction by only exploring syntactically valid candidates, but they still spend significant effort on semantically invalid candidates. In this paper, we propose a model-guided approach to speed up test case reduction. The approach trains a model of semantic properties driven by syntactic test case properties. By using this model, we can skip testing even syntactically valid test case candidates that are unlikely to succeed. We evaluate this model-guided reduction on a suite of 14 large fuzzer-generated C test cases from the bug repositories of two well-known C compilers, GCC and Clang. Our results show that with an average precision of 77%, we can decrease the number of removal trials by 14% to 61%. We observe a 30% geomean improvement in reduction time over the state of the art technique while preserving similar reduction power.

cs.SE↗