一种针对JavaScript引擎JIT编译器的模糊测试方法  

A Fuzzing Method for JIT Complier of JavaScript Engine

作　　者：王越[1] 孙亮 王轶骏[1] 薛质[1] WANG Yue;SUN Liang;WANG Yijun;XUE Zhi(Shanghai Jiaotong University,Shanghai 200240,China;Nantong Public Security Bureau,Nantong Jiangsu 226001,China)

机构地区：[1]上海交通大学,上海200240 [2]江苏省南通市公安局,江苏南通226001

出　　处：《通信技术》2021年第1期175-180,共6页Communications Technology

基　　金：国家重点研发计划项目“网络空间安全”重点专项(No.2017YFB0803203)。

摘　　要：JavaScript引擎的安全性是浏览器安全的重要一环,以往针对JavaScript引擎的模糊测试工具很难针对JIT编译器部分进行有效挖掘。对此提出了一种针对JIT编译器的模糊测试方法,使用基于中间语言的生成算法生成JIT种子文件,在保持该种子文件中间语言结构的情况下进行变异。相比于其他模糊测试工具,本方法的测试样本有更高的模糊测试JIT编译器的成功率,并能达到更高的JIT编译器的覆盖率,从而表明该方法针对JIT编译器的模糊测试具有更好的性能优越性。The security of JavaScript engine is an important part of browser security.In the past,the fuzzing tools for JavaScript engine were difficult to effectively mine the JIT compiler part.In this regard,a fuzzing method for JIT compilers is proposed,which uses an intermediate language-based generation algorithm to generate JIT seed files,and mutates while maintaining the intermediate language structure of the seed files.Compared with other fuzzing tools,the testcases of this method have a higher success rate of fuzzing the JIT complier,and can reach a higher coverage rate of the JIT complier,which indicates that the method has better performance superiority for JIT compiler fuzz testing.

关 键 词：JAVASCRIPT引擎 JIT编译器 模糊测试 覆盖率 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]