一句话：提出 TemuJs，从真实 JS 程序中抽取抽象模板并在模板层做语义感知变异，为 JS 引擎生成多样化且有效的测试用例。
JavaScript 引擎需要实现复杂的语言语义与优化策略以支持 JS 的动态特性，因此难以被充分测试，容易潜伏细微却安全攸关的缺陷。现有模糊测试器难以生成多样且合法的测试用例：要么依赖缺乏语义感知的语法层变异，要么只能在具体代码上做有限的局部变异，无法触及更深层、更复杂的程序行为。本文提出 TemuJs，一个在高层进行抽取与变异的模糊测试框架：它从真实 JS 程序中抽取抽象模板，模板以语义占位符刻画粗粒度的程序结构，从而支持语义感知的变异——在保留原始代码高层意图的同时使其行为多样化。通过将变异与具体语法解耦，并借助结构化的中间表示来承载模板，TemuJs 得以探索更广阔、更有意义的程序行为空间。作者在 V8、SpiderMonkey 和 JavaScriptCore 三个主流引擎上评估，共发现 44 个缺陷，边覆盖平均比当前最优模糊测试器相对提升 10.3%，验证了高层模板变异式模糊测试在 JS 引擎测试中的有效性。
JavaScript (JS) engines implement complex language semantics and optimization strategies to support the dynamic nature of JS, making them difficult to test thoroughly and prone to subtle, security-critical bugs. Existing fuzzers often struggle to generate diverse and valid test cases. They either rely on syntax-level mutations that lack semantic awareness or perform limited, local mutations on concrete code, thus failing to explore deeper, more complex program behaviors. This paper presents TemuJs , a novel fuzzing framework that performs extraction and mutation at a high level, operating on abstract templates derived from real-world JS programs. These templates capture coarse-grained program structures with semantic placeholders, enabling semantics-aware mutations that preserve the high-level intent of the original code while diversifying its behavior. By decoupling mutation from concrete syntax and leveraging a structured intermediate representation for the templates, TemuJs explores a broader and more meaningful space of program behaviors. Evaluated on three major JS engines, namely, V8, SpiderMonkey, and JavaScriptCore, TemuJs discovers 44 bugs and achieves a 10.3% relative increase in edge coverage compared to state-of-the-art fuzzers on average. Our results demonstrate the efficacy of high-level, template-mutation fuzzing in testing JS engines.
@article{paperbot2992,
title = {Extraction and Mutation at a High Level: Template-Based Fuzzing for JavaScript Engines},
author = {Wai Kin Wong and Dongwei Xiao and Cheuk Tung Lai and Yiteng Peng and Daoyuan Wu and Shuai Wang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA2},
year = {2025},
doi = {10.1145/3763154}
}