一句话：提出差分测试框架 ZendDiff，通过对比 JIT 与非 JIT 执行结果自动检测 PHP 解释器的逻辑错误。
PHP 解释器支撑着互联网上超过 70% 的网站，但现有针对 PHP 的缺陷检测工作主要通过崩溃或 sanitizer 预言来发现显式安全问题，难以识别会静默导致错误结果的逻辑缺陷。作者观察到 PHP 引入的 JIT 编译模式为差分测试提供了契机：JIT 与解释执行是同一语言规范的两种实现，二者结果应当一致。基于此，论文提出 ZendDiff 这一自动差分测试框架，通过比较 JIT 与非 JIT 的执行结果来发现逻辑缺陷。该框架包含三项关键技术：程序状态探测以实现细粒度的执行状态比较、感知 JIT 的程序变异以充分覆盖 JIT 功能，以及双重重验证以处理 PHP 程序中的非确定性行为。实验表明，ZendDiff 相比 PHP 持续集成中使用的官方测试套件具有更高的代码覆盖率和更多的 Zend 操作码执行量，消融实验验证了各技术的有效性。目前 ZendDiff 已在 PHP 解释器中发现 51 个此前未知的逻辑缺陷，其中 37 个已被修复、3 个得到维护者确认，并获得 PHP 社区认可。
The PHP interpreter, powering over 70% of web-sites on the internet, plays a crucial role in web development. Existing approaches to finding bugs in PHP primarily focus on detecting explicit security issues through crashes or sanitizer-based oracles, but fail to identify logic bugs that can silently lead to incorrect results. We observe that the introduction of Just-In-Time (JIT) compilation mode in PHP presents an opportunity for differential testing, as it provides an alternative implementation of the same language specification. We propose, ZendDiff, an automatic differential testing framework that effectively detects logic bugs in the PHP interpreter by comparing JIT and non-JIT execution results. Our differential testing incorporates three techniques: program state probing for fine-grained execution state comparison, JIT-aware program mutation to sufficiently exercise JIT functionality, and dual verification to handle non-deterministic behaviors in PHP programs. Our experimental results demonstrate that ZendDiffoutperforms the official test suite used in PHP’s continuous integration, achieving higher code coverage and executing more Zend opcodes. Through ablation studies, we validate the effectiveness of these techniques. To date, ZendDiffhas identified 51 previously unknown logic bugs in the PHP interpreter, with 37 already fixed and 3 confirmed by the PHP maintainers. ZendDiffhas been acknowledged by the PHP community and offers a practical tool for automatically discovering logic bugs in the PHP interpreter.
DOI 原文 ·
@inproceedings{paperbot9512,
title = {ZendDiff: Differential Testing of PHP Interpreter},
author = {Yuancheng Jiang and Jianing Wang and Qiange Liu and Yeqi Fu and Jian Mao and Roland H. C. Yap and Zhenkai Liang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00095}
}