一句话：提出覆盖率引导的 JVM JIT 编译器模糊测试框架，通过优化激活变异与调度高效发现 JIT 缺陷。
JVM 的实时解释机制带来严重性能损失，即时编译器（JIT）被广泛采用，因此高效检测 JIT 缺陷对保证 JVM 正确性至关重要。本文提出覆盖率引导的模糊测试框架 JITfuzz：设计优化激活变异器以触发函数内联、简化等典型 JIT 优化；针对优化与控制流紧密耦合，引入控制流丰富变异器；并利用变异器调度器根据覆盖率反馈迭代选择变异器，最大化 JIT 代码覆盖率。在 GitHub 上 16 个流行 JVM 项目上的评估表明，JITfuzz 的平均边覆盖率分别比最先进的基于变异和基于生成的 JVM 模糊器高 27.9% 和 18.6%，并发现 36 个未知缺陷（含 23 个 JIT 缺陷），其中 27 个（含 18 个 JIT 缺陷）已被开发者确认。
As a widely-used platform to support various Java-bytecode-based applications, Java Virtual Machine (JVM) incurs severe performance loss caused by its real-time program interpretation mechanism. To tackle this issue, the Just-in- Time compiler (JIT) has been widely adopted to strengthen the efficacy of JVM. Therefore, how to effectively and efficiently detect JIT bugs becomes critical to ensure the correctness of JVM. In this paper, we propose a coverage-guided fuzzing framework, namely JITfuzz, to automatically detect JIT bugs. In particular, JITfuzz adopts a set of optimization-activating mutators to trigger the usage of typical JIT optimizations, e.g., function inlining and simplification. Meanwhile, given JIT optimizations are closely coupled with program control flows, JITfuzz also adopts mutators to enrich the control flows of target programs. Moreover, JITfuzz also proposes a mutator scheduler which iteratively schedules mutators according to the coverage updates to maximize the code coverage of JIT. To evaluate the effectiveness of JITfuzz, we conduct a set of experiments based on a benchmark suite with 16 popular JVM-based projects from GitHub. The experimental results suggest that JITfuzz outperforms the state-of-the-art mutation-based and generation-based JVM fuzzers by 27.9 % and 18.6 % respectively in terms of edge coverage on average. Furthermore, JITfuzz also successfully detects 36 previously unknown bugs (including 23 JIT bugs) and 27 bugs (including 18 JIT bugs) have been confirmed by the developers.
@inproceedings{WuLCCZZ23,
title = {JITfuzz: Coverage-guided Fuzzing for JVM Just-in-Time Compilers},
author = {Mingyuan Wu and Minghai Lu and Heming Cui and Junjie Chen and Yuqun Zhang and Lingming Zhang},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00017}
}