Fuzzing JavaScript Engines with a Graph-based Intermediate Representation

This document is a research article that presents a novel approach to fuzzing JavaScript (JS) engines using a graph-based intermediate representation called FlowIR. The article outlines the limitations of current mutation-based fuzzers, which typically rely on abstract syntax trees or bytecode-level representations, and highlights the challenges in generating semantically valid mutations. FlowIR addresses these challenges by directly modeling the control flow and data flow of JS programs, allowing for more effective semantic mutations. The authors describe the design of FlowIR and its advantages, including improved syntax correctness and semantic validity of generated test cases. The article details the implementation of a prototype fuzzer named FuzzFlow, which utilizes FlowIR and demonstrates its effectiveness in discovering new defects in mainstream JS engines. Experimental results indicate that FuzzFlow outperforms existing fuzzers, achieving a higher rate of valid test cases and increased code coverage, ultimately identifying 37 new defects in widely used JS engines.