基于深度模糊技术的JavaScript发动机可控性自动测试
Automated Conformance Testing for JavaScript Engines via Deep Compiler Fuzzing
摘要：
JavaScript（JS）是一种流行的、与平台无关的程序设计语言。为了确保JS程序在不同平台上的互操作性，JS引擎的实现应该符合ECMAScript标准。然而，这样做是具有挑战性的，因为API行为有许多微妙的定义，并且定义不断发展。我们提出了COMFORT，一个新的编译器模糊框架，用于检测JS引擎的错误和行为偏离ECMAScript标准。COMFORT利用基于深度学习的语言模型的最新进展，自动生成JS测试代码。与以前的模糊器不同，COMFORT利用结构良好的ECMAScript规范自动生成测试数据以及测试程序，以暴露开发人员或手动编写的测试用例可能忽略的错误。然后，COMFORT在生成的测试用例上应用差异测试方法，以暴露标准一致性错误。我们将COMFORT应用于十个主流JS引擎。在200小时的自动化并发测试运行中，我们发现了所有测试过的JS引擎中的错误。我们已经确定了158个独特的JS引擎错误，其中129个已经得到验证，115个已经被开发人员修复。此外，21个Comfort生成的测试用例已添加到Test262，官方ECMAScript一致性测试套件。
英文摘要：
JavaScript (JS) is a popular, platform-independent programming language. To ensure the interoperability of JS programs across different platforms, the implementation of a JS engine should conform to the ECMAScript standard. However, doing so is challenging as there are many subtle definitions of API behaviors, and the definitions keep evolving. We present COMFORT, a new compiler fuzzing framework for detecting JS engine bugs and behaviors that deviate from the ECMAScript standard. COMFORT leverages the recent advance in deep learning-based language models to automatically generate JS test code. As a departure from prior fuzzers, COMFORT utilizes the well-structured ECMAScript specifications to automatically generate test data along with the test programs to expose bugs that could be overlooked by the developers or manually written test cases. COMFORT then applies differential testing methodologies on the generated test cases to expose standard conformance bugs. We apply COMFORT to ten mainstream JS engines. In 200 hours of automated concurrent testing runs, we discover bugs in all tested JS engines. We had identified 158 unique JS engine bugs, of which 129 have been verified, and 115 have already been fixed by the developers. Furthermore, 21 of the Comfort-generated test cases have been added to Test262, the official ECMAScript conformance test suite.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
