AddressSanitizer: A Fast Address Sanity Checker
https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/37752.pdf
Method
"The Chromium open-source browser has been regularly tested with AddressSanitizer since we released the tool in May 2011. In the first 10 months of testing the tool detected over 300 previously unknown bugs in the Chromium code and in third-party libraries."
Population
"210 bugs were heap-use-after-free, 73 were heap-buffer-overflow, 8 global-buffer-overflow, 7 stack-buffer-overflow and 1 memcpy parameter overlap."
What it does not show
Bugs found is not bugs that would have shipped: the paper does not classify how many were security-critical or would have become CVEs. No false-negative rate, and no control group’s eventual defect rate. Overheads are benchmark-specific and C/C++ only.
Konstantin Serebryany, Derek Bruening, Alexander Potapenko, Dmitry Vyukov
Over 300 previously unknown memory-safety bugs in ten months of continuous use, with a breakdown by class, at 73% average slowdown and 3.4x memory — low enough to run in unit tests and fuzzing, against roughly 20x for the previous generation of tools.
Tier III: Single-organisation engineering report with measured overheads and production bug counts, with baseline comparisons against prior tools but no controlled trial.