Fuzzing JavaScript JIT Compilers with Optimization Path Feedback

Just-In-Time (JIT) compiler is a core component of JavaScript engines, which takes JavaScript code as input and applies a series of optimization passes on it and transforms it to machine code. The optimization passes often have some assumptions (e.g., variable types) on the input program, and therefore will yield vulnerabilities if the assumptions are violated. To discover such bugs, it is essential to thoroughly test different optimization passes, but previous work fails to do so and mainly focused on exploring code coverage. In this paper, we present the first optimization path guided fuzzing solution for JavaScript JIT compilers, namely OptFuzz, which focuses on exploring optimization paths. Specifically, we utilize an optimization subpath metric to approximate the optimization path, and use it as feedback to guide seed preservation and seed scheduling. Furthermore, we identify optimization triggering by analyzing code transformations at the JIT intermediate representation (IR) level, and preserve optimization subpaths only when optimizations are triggered. We implemented OptFuzz on four baseline fuzzers and evaluated it on 4 mainstream JavaScript engines. On earlier engine versions, OptFuzz found several times more bugs than baselines. On the latest engines, OptFuzz discovered 52 new bugs, among which 43 have been confirmed or fixed.