JATTACK: Java JIT Testing using Template Programs
JATTACK: Java JIT Testing using Template Programs
复制标题
DOI：
10.1109/icse-companion58688.2023.00014
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Zhiqiang Zang;Fu-Yao Yu;Nathan Wiatrek;Miloš Gligorić;A. Shi
中科院分区：
文献类型：
--
作者：
Zhiqiang Zang;Fu-Yao Yu;Nathan Wiatrek;Miloš Gligorić;A. Shi
我们提出JATTACK，一个框架，使编译器测试使用模板。JATTACK允许编译器开发人员编写一个模板程序，描述一组用于测试编译器的具体程序。这种基于模板的方法通过允许开发人员以主编程语言（Java）编写模板程序来利用开发人员对测试编译器的直觉，该模板程序包含基本程序结构，同时提供了在孔中表达特定语言构造的变体的机会。每一个以嵌入在宿主语言中的领域特定语言编写的洞被用于构造扩展抽象语法树（eAST），其定义语言构造的搜索空间，例如，一组数字、表达式、语句等。JATTACK执行模板程序，通过在由漏洞定义的搜索空间内随机选择一个数字、表达式或语句来填充每个漏洞，并生成填充所有漏洞的具体程序。我们使用JATTACK测试Java即时（JIT）编译器，我们发现了Oracle JDK JIT编译器中的七个关键错误。Oracle开发人员确认并修复了所有七个错误，其中五个是以前未知的，包括两个CVE（常见漏洞和暴露）。JATTACK将开发人员通过模板的直觉与随机测试相结合，以检测编译器中的错误。JATTACK的演示视频可以在https://www.youtube.com/watchvmeCFPxucqk4上找到
We present JATTACK, a framework that enables compiler testing using templates. JATTACK allows compiler developers to write a template program that describes a set of concrete programs to be used to test compilers. Such a template-based approach leverages developers' intuition on testing compilers, by allowing developers to write a template program in the host programming language (Java), which contains a basic program structure while provides an opportunity to express variants of specific language constructs in holes. Each hole, written in a domain-specific language embedded in the host language, is used to construct an extended abstract syntax tree (eAST), which defines the search space of a language construct, e.g., a set of numbers, expressions, statements, etc. JATTACK executes the template program to fill every hole by randomly choosing a number, expression, or statement within the search space defined by the hole, and it generates concrete programs with all holes filled. We used JATTACK to test Java just-in-time (JIT) compilers, and we have found seven critical bugs in Oracle JDK JIT compiler. Oracle developers confirmed and fixed all seven bugs, five of which were previously unknown, including two CVEs (Common Vulnerabilities and Exposures). JATTACK blends developers' intuition via templates with random testing to detect bugs in compilers. The demo video for JATTACK can be found at https://www.youtube.com/watchvmeCFPxucqk4