一句话：提出字节码驱动的模糊测试方法 BCFuzz，提升生成字节码的多样性并加强低频字节码测试，在四个 JS 引擎中发现 20 个新缺陷。
现代 JavaScript 引擎的解释器与 JIT 编译器都以字节码为输入，且其中多数缺陷与特定字节码密切相关。然而已有模糊测试工作主要关注测试用例的语法与语义合法性，忽略了字节码的生成与覆盖方式，导致部分字节码从未被触发、另一些则触发频率过低。本文提出 BCFuzz：一方面设计面向解析器的探测技术，识别生成特定字节码所需的必要条件，并用这些信息增强输入生成过程；另一方面提出字节码感知的种子保留、调度与变异策略，以更有针对性地测试低频字节码。作者在四个主流 JavaScript 引擎上评估 BCFuzz，72 小时测试中发现的问题数量分别是 DIE 的 1.73 倍和 Fuzzilli 的 1.67 倍，共发现 20 个此前未知的缺陷，其中 17 个已被修复，1 个获得 CVE 编号，且所有发现的缺陷均与字节码相关。
The interpreter and the Just-In-Time (JIT) compiler are two core components of modern JavaScript engines, both of which take bytecodes as input. Most bugs in these components are closely related to specific bytecodes. Therefore, effective fuzzing should pay close attention to how bytecode is generated and exercised. However, previous work fails to consider this aspect and instead focuses primarily on the syntactic and semantic validity of test cases. This causes two major issues: 1) certain bytecodes are never exercised during fuzzing; 2) some bytecodes are exercised infrequently. In this paper, we propose BCFuzz, a bytecode-driven fuzzing approach designed to enhance the diversity of generated bytecode and increase testing opportunities for low-frequency bytecodes. Specifically, we introduce a parser-oriented probing technique to identify the necessary conditions for generating specific bytecodes and use this information to enhance the input generation process. To better test low-frequency bytecodes, we propose bytecode-aware seed preservation, scheduling, and mutation strategies. We evaluate BCFuzz on four mainstream JavaScript engines. In 72 hours of testing, BCFuzz discovers 1.73× and 1.67× more bugs than DIE and Fuzzilli, respectively. In total, BCFuzz uncovered 20 previously unknown bugs. Of these, 17 have already been fixed and one has been assigned a CVE. All the discovered bugs are related to bytecodes.
DOI 原文 ·
@inproceedings{paperbot9453,
title = {BCFuzz: Bytecode-Driven Fuzzing for JavaScript Engines},
author = {Jiming Wang and Chenggang Wu and Jikai Ren and Yuhao Hu and Yan Kang and Xiaojie Wei and Yuanming Lai and Mengyao Xie and Zhe Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00096}
}