一句话:提出 MopFuzzer,通过最大化 JVM 编译器优化阶段间的交互并进行差分测试,发现 59 个生产 JVM 缺陷。
现代编译器中的内联、循环展开和死代码消除等优化阶段并非一次性顺序完成,而是相互交织;处理某一优化时若破坏其他优化结果,可能导致编译器崩溃或不可预期行为。为验证 JVM 编译器能否正确处理跨阶段优化,作者提出 MopFuzzer:在模糊测试中最大化运行时优化交互。它实现 13 个 mutator,迭代作用于同一程序点以触发特定优化,并利用记录编译器优化行为的 profile 数据引导测试,生成能最大化优化行为及其交互的变异体,再通过差分测试校验优化代码正确性。评估向 OpenJDK 与 OpenJ9 提交了 59 个缺陷报告。
This paper introduces the concept of optimization interaction, which refers to the practice in modern compilers where multiple optimization phases, such as inlining, loop unrolling, and dead code elimination, are not completed in a one-off sequential order while being interacted instead. Therefore, while optimizing a certain phase, the compiler needs to ensure that the results of other optimization phases will not be disrupted, as this could lead to compiler crashes or unpredictable results. To verify whether compilers can correctly handle the optimization process across various phases, we propose MopFuzzer, which aims at maximizing runtime optimization interactions during fuzzing. Specifically, it encourages the JVM to perform multi-stage optimizations and verifies the correctness of the compiler's optimized code through differential testing. Currently, MopFuzzer has implemented 13 mutators, and each is intended to trigger a certain optimization behavior. Such mutators are applied iteratively to the same program point, aiming to maximize optimization interactions. Subsequently, the testing process is guided by a novel method based on profile data, which records the optimization behaviors performed by the compiler. The guidance enables MopFuzzer to generate mutants that are able to maximize optimization behaviors and their interactions. Our evaluation has led to 59 bug reports for widely used production JVMs, OpenJDK and OpenJ9.