Abstract: JavaScript is extensively utilized in development scenarios such as servers and embedded devices. As the compiler and executor of JavaScript, the JavaScript engine is particularly vulnerable to security flaws, which can easily result in significant security incidents. Consequently, JavaScript engines fuzzing has been a research hotspot. However, existing fuzzing techniques for JavaScript engines often suffer from issues such as low test case validity and insufficient diversity. To address these challenges, this paper introduces a novel fuzzing approach grounded in dynamic semantic feedback. By dynamically collecting, analyzing, and feeding back runtime semantic information, the proposed method improves the validity of test cases. On this basis, the mutation strategies of expression replacement and function creation are employed to enhance the syntactic exploration capability of the test cases. This paper implemented a prototype system, DSFfuzz. In a comparative fuzzing experiments using the JerryScript engine, DSFfuzz demonstrated an average improvement of 11.81% in test case validity compared to three stateoftheart approaches and identified the highest number of crashes, including 15 unique ones. These results validate the effectiveness of the proposed method.

Key words: JavaScript engine, fuzzing, abstract syntax tree, code brick assembly, dynamic semantic feedback

摘要： JavaScript在服务器、嵌入式设备等开发场景中广泛应用，JavaScript引擎作为其编译和执行器，其中的安全漏洞极易引发大范围安全事件，因此针对JavaScript引擎的模糊测试成为研究热点.现有JavaScript引擎模糊测试技术生成的测试用例存在有效率低、多样性不足等问题.针对这些问题，提出一种基于动态语义反馈的模糊测试方法，通过运行时语义信息的动态收集、分析和反馈机制辅助测试用例生成，提高测试用例的有效率.在此基础上，采用表达式替换和函数创建等用例变异策略，提高测试用例的语法探索能力.实现了JavaScript引擎模糊测试原型系统DSFfuzz，在JerryScript引擎的模糊测试对比实验中，DSFfuzz相较于3个先进工作测试用例有效率平均提升了11.81%，且触发的独特崩溃最多，发现了15个独特崩溃，证明了该方法的有效性.

关键词: JavaScript引擎, 模糊测试, 抽象语法树, 代码块组装, 动态语义反馈