JITfuzz: Coverage-guided Fuzzing for JVM Just-in-Time Compilers
As a widely-used platform to support various Java-bytecode-based applications, Java Virtual Machine (JVM) incurs severe performance loss caused by its real-time program interpretation mechanism. To tackle this issue, the Just-in-Time compiler (JIT) has been widely adopted to strengthen the efficacy of JVM. Therefore, how to effectively and efficiently detect JIT bugs becomes critical to ensure the correctness of JVM. In this paper, we propose a coverage-guided fuzzing framework, namely JITfuzz, to automatically detect JIT bugs. In particular, JITfuzz adopts a set of optimization-activating mutators to trigger the usage of typical JIT optimizations, e.g., function inlining and simplification. Meanwhile, given JIT optimizations are closely coupled with program control flows, JITfuzz also adopts mutators to enrich the control flows of target programs. Moreover, JITfuzz also proposes a mutator scheduler which iteratively schedules mutators according to the coverage updates to maximize the code coverage of JIT. To evaluate the effectiveness of JITfuzz, we conduct a set of experiments based on a benchmark suite with 16 popular JVM-based projects from GitHub. The experimental results suggest that JITfuzz outperforms the state-out-the-art mutation-based and generation-based JVM fuzzers by 27.9% and 18.6% respectively in terms of edge coverage on average. Furthermore, JITfuzz also successfully detects 36 previously unknown bugs (including 23 JIT bugs) and 27 bugs (including 18 JIT bugs) have been confirmed by the developers.
Wed 17 MayDisplayed time zone: Hobart change
11:00 - 12:30 | Fuzzing: applicationsTechnical Track / DEMO - Demonstrations at Meeting Room 101 Chair(s): Corina S. Păsăreanu Carnegie Mellon University | ||
11:00 15mTalk | Detecting JVM JIT Compiler Bugs via Exploring Two-Dimensional Input Spaces Technical Track Haoxiang Jia Huazhong University of Science and Technology, Ming Wen Huazhong University of Science and Technology, Zifan Xie Huazhong University of Science and Technology, Xiaochen Guo Huazhong University of Science and Technology, Rongxin Wu Xiamen University, Maolin Sun Huazhong University of Science and Technology, Kang Chen Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology Pre-print | ||
11:15 15mTalk | JITfuzz: Coverage-guided Fuzzing for JVM Just-in-Time Compilers Technical Track Mingyuan Wu Southern University of Science and Technology, Minghai Lu Southern University of Science and Technology, Heming Cui University of Hong Kong, Junjie Chen Tianjin University, Yuqun Zhang Southern University of Science and Technology, Lingming Zhang University of Illinois at Urbana-Champaign | ||
11:30 15mTalk | Validating SMT Solvers via Skeleton Enumeration Empowered by Historical Bug-Triggering Inputs Technical Track Maolin Sun Huazhong University of Science and Technology, Yibiao Yang Nanjing University, Ming Wen Huazhong University of Science and Technology, Yongcong Wang Huazhong University of Science and Technology, Yuming Zhou Nanjing University, Hai Jin Huazhong University of Science and Technology Pre-print | ||
11:45 15mTalk | Regression Fuzzing for Deep Learning Systems Technical Track Hanmo You College of Intelligence and Computing, Tianjin University, Zan Wang Tianjin University, China, Junjie Chen Tianjin University, Shuang Liu Tianjin University, Shuochuan Li College of Intelligence and Computing, Tianjin University | ||
12:00 15mTalk | Operand-Variation-Oriented Differential Analysis for Fuzzing Binding Calls in PDF Readers Technical Track Suyue Guo Renmin University of China, Xinyu Wan Renmin University of China, Wei You Renmin University of China, Bin Liang Renmin University of China, China, Wenchang Shi Renmin University of China, China, Yiwei Zhang Renmin University of China, Jianjun Huang Renmin University of China, China, Jian Zhang State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing, China Pre-print | ||
12:15 7mTalk | JAttack: Java JIT Testing using Template Programs DEMO - Demonstrations Zhiqiang Zang University of Texas at Austin, Fu-Yao Yu The University of Texas at Austin, Nathan Wiatrek The University of Texas at Austin, Milos Gligoric University of Texas at Austin, August Shi University of Texas at Austin Pre-print | ||