一句话：提出首个带种子与变异器调度的 JVM 模糊测试框架，通过差异测试高效暴露 JVM 间执行差异。
现有 JVM 测试技术利用模糊测试与差异测试暴露不同 JVM 间的执行差异，但其 fuzzer 缺乏种子和变异器调度机制，导致差异测试效率不足。本文提出 SJFuzz，首个面向自动化 JVM 差异测试、具备种子与变异器调度机制的模糊测试框架。SJFuzz 通过控制流变异器变异 class 文件以促进 JVM 间差异暴露；基于差异暴露与多样性反馈调度种子，并调度变异器以增加生成 class 文件的多样性。作者在多个代表性真实 JVM 上开展实验，结果表明 SJFuzz 在 JVM 间差异暴露和 class 文件多样性上显著优于当前基于变异和基于生成的 JVM fuzzer，并报告 46 个潜在 JVM 问题，其中 20 个被确认是 bug，16 个已被开发者修复。
While the Java Virtual Machine (JVM) plays a vital role in ensuring correct executions of Java applications, testing JVMs via generating and running class files on them can be rather challenging. The existing techniques, e.g., ClassFuzz and Classming, attempt to leverage the power of fuzzing and differential testing to cope with JVM intricacies by exposing discrepant execution results among different JVMs, i.e., inter-JVM discrepancies, for testing analytics. However, their adopted fuzzers are insufficiently guided since they include no well-designed seed and mutator scheduling mechanisms, leading to inefficient differential testing. To address such issues, in this paper, we propose SJFuzz, the first JVM fuzzing framework with seed and mutator scheduling mechanisms for automated JVM differential testing. Overall, SJFuzz aims to mutate class files via control flow mutators to facilitate the exposure of inter-JVM discrepancies. To this end, SJFuzz schedules seeds (class files) for mutations based on the discrepancy and diversity guidance. SJFuzz also schedules mutators for diversifying class file generation. To evaluate SJFuzz, we conduct an extensive study on multiple representative real-world JVMs, and the experimental results show that SJFuzz significantly outperforms the state-of-the-art mutation-based and generation-based JVM fuzzers in terms of the inter-JVM discrepancy exposure and the class file diversity. Moreover, SJFuzz successfully reported 46 potential JVM issues, and 20 of them have been confirmed as bugs and 16 have been fixed by the JVM developers.
@inproceedings{WuOLCZC0Z23,
title = {SJFuzz: Seed and Mutator Scheduling for JVM Fuzzing},
author = {Mingyuan Wu and Yicheng Ouyang and Minghai Lu and Junjie Chen and Yingquan Zhao and Heming Cui and Guowei Yang and Yuqun Zhang},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616277}
}