Treffer: Fuzzing JavaScript JIT compilers with a high-quality differential test oracle.

Modern JavaScript engines use Just-In-Time (JIT) compilers to convert frequently executed code into machine instructions, boosting performance for web applications and cross-platform systems. However, the optimizations in JIT compilers often introduce vulnerabilities while enhancing speed, especially optimization bugs which are difficult to detect. Despite progress in detecting these bugs by using differential testing oracle, existing methods are limited by high false positives and inefficiencies. This paper proposes AccuOracle, a test oracle for detecting JIT optimization bugs. We uses an input template-based test oracle that collects differential results from a single execution, enabling efficient fuzzing. To address the high false positive challenge, AccuOracle employs a four-layer progressive filtering architecture: the dynamism elimination and environment isolation layers address root causes, while the pre-check and differential arbitration layers assess JIT-induced divergences. Experiments on engines like V8, SpiderMonkey, and JavaScriptCore show that AccuOracle effectively eliminates false positives while maintaining high operational efficiency. It provides a high-accuracy and high-efficiency solution for JIT defect detection by integrating high-quality input templates and systematic false positive elimination. Notably, AccuOracle has uncovered eight new bugs (two of them have been assigned CVE), five of which Mozilla has confirmed and fixed. [ABSTRACT FROM AUTHOR]

Copyright of Computers & Security is the property of Pergamon Press - An Imprint of Elsevier Science and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)