JFuzzer: Detecting Optimization Errors in JavaScript Just-In-Time Compilers

As a crucial component of the internet, JavaScript plays an essential role in various web applications. However, to meet the demands of high-speed user experiences and an increasing array of functionalities, computationally intensive operations are becoming more frequent in JavaScript. This poses challenges for JavaScript engines. Consequently, in response to this situation, modern JavaScript engines are equipped with efficient just-in-time (JIT) compilers. Unfortu-nately, while optimizing code, JIT compiler introduces some security vulnerabilities due to its inherent complexity, thereby offering attackers a broad surface. In terms of vulnerability detection, fuzzing has consistently been considered an effective method for detecting bugs. However, existing JavaScript fuzzers are not mainly designed specifically for detecting JIT compiler vulnerabilities, making it challenging for them to uncover JIT-exclusive bugs. In this paper, we propose a new method called JFuzzer, specifically designed for detecting JIT compiler bugs. Specifically, we use some mutation strategies on the intermediate representation (IR) of JavaScript code to improve their syntactic and semantic correctness. On the other hand, we strive to ensure that the test cases can activate the JIT compiler each time. By employing the idea of differential testing, we compare the results when using the JavaScript engine's interpreter and the corresponding JIT compiler. This allows us to detect potential vulnerabilities in the JIT compiler. Through extensive experiments, our method has improved coverage on three widely used JavaScript engines.