JavaScript Engine Research Articles

Fuzzing JavaScript engines with a syntax-aware neural program model

Neural network language modeling has become a remarkable approach in the generation of test cases for fuzzing JavaScript engines. Fuzzers built upon neural language models offer several advantages. They obviate the need for manually developing code generation rules, enable the extraction of patterns from high-quality seed sets, and exhibit commendable portability. Nevertheless, existing works confront challenges in three key aspects: diminished language modeling performance attributable to extensive vocabularies, potential semantic errors within generated test cases, and the limitation of black-box fuzzing, which fails to leverage the internal feedback from the target engine.This paper proposes an innovative neural model-based grey-box fuzzing approach for JavaScript engines. We incorporate the context-free grammar of JavaScript into the neural language model to mitigate the challenges associated with extensive vocabularies, thereby enhancing the model’s performance. Furthermore, to enhance the semantic validity of the generated test cases, we introduce semantic constraints into the mutation process. Notably, this work pioneers the integration of grey-box testing into a fuzzer built upon a neural language model, thereby enhancing the exploration of deep paths. Our prototype, PMFuzz, surpasses NNLM-based counterparts in both language modeling performance and test case generation capabilities. PMFuzz demonstrates a high level of competitiveness in exploring the software state space when compared to traditional coverage-guided grey-box fuzzers. In our evaluation, PMFuzz successfully identified 20 new defects within mainstream JS engines. Eight of them have been confirmed and fixed. Moreover, upon applying our method to C compilers, PMFuzz has revealed 11 new defects.

Accelerating page loads via streamlining JavaScript engine for distributed learning

Distributed learning based on JavaScript-based frontends is typically implemented at the endpoint to maximize performance. Yet, JavaScript-based frontends often experience suboptimal performance. To reconcile these disparities in performance between EDGE and endpoint deployments, strategic optimization is essential, particularly for preserving privacy in distributed learning. Real-time streaming optimizations are imperative to align the performance of disparate components for smooth integration. The reliance on JavaScript for various web functionalities can lead to increased resource consumption and slower page loads. Thus, we introduce a streamlined JavaScript engine designed to optimize structural patterns in JavaScript code, with three key enhancements. Firstly, we reduce the computational burden of the JavaScript engine necessary for setting up the browser's runtime environment. Secondly, we refine the parsing process for specific code patterns, boosting the efficiency of our lightweight engine. Thirdly, we streamline the Inter-Process Communication (IPC) to maintain high performance, even with limited memory resources. Our evaluations demonstrate that our approach reduces the median Total Computation Time (TCT) by 45.2%, and surpasses existing leading solutions, Siploader and Prepack, with improvements ranging from 1.13× to 1.39×.

Evaluating seed selection for fuzzing JavaScript engines

Evaluating seed selection for fuzzing JavaScript engines

An empirical study on bugs in JavaScript engines

JavaScript is a prototype-based dynamic type scripting language. The correct running of a JavaScript program depends on the correctness of both the program and the JavaScript engine.

JS Capsules: A Framework for Capturing Fine-grained JavaScript Memory Measurements for the Mobile Web

Understanding the resource consumption of the mobile web is an important topic that has garnered much attention in recent years. However, existing works mostly focus on the networking or computational aspects of the mobile web and largely ignore memory, which is an important aspect given the mobile web's reliance on resource-heavy JavaScript. In this paper, we propose a framework, called JS Capsules, for characterizing the memory of JavaScript functions and, using this framework, we investigate the key browser mechanics that contribute to the memory overhead. Leveraging our framework on a testbed of Android mobile phones, we conduct measurements of the Alexa top 1K websites. While most existing frameworks focus on V8 - the JavaScript engine used in most popular browsers - in the context of memory, our measurements show that the memory implications of JavaScript extends far beyond V8 due to the cascading effects that certain JavaScript calls have on the browser's rendering mechanics. We quantify and highlight the direct impact that website DOM have on JavaScript memory overhead and present, to our knowledge, the first root-cause analysis to dissect and characterize their impact on JavaScript memory overheads.

Dynamic code compression for JavaScript engine

AbstractWeb applications created using web languages such as HTML, CSS, and JavaScript are widely used regardless of execution environments, owing to their portability and popularity. Since JavaScript language is conventionally used for complex computations in large‐scale web apps, many optimization techniques have been proposed to accelerate the JavaScript performance. However, most of these optimizations speed up JavaScript engines at the expense of consuming more memory. Hence, memory consumption becomes an additional concern in the JavaScript field. Based on the research on memory status, we unearthed that a substantial portion of the heap memory is allocated for JavaScript source code, particularly in lightweight JavaScript engines, which may range from 13.2% to a maximal 52.5% of the entire heap. To resolve this memory issue, this article suggests a new memory optimization method, called dynamic code compression that dynamically compresses the source code and keeps its compressed form instead of the source string. A novel heuristic is proposed to timely compress the source code. We also re‐design the internal structure of the JavaScript engine to efficiently compress the source code without incurring any conflict. Using our code compression method, we could reduce the entire heap memory by up to 43.3% and consistently downsize the overall heap size. From an evaluation of standard benchmarks, our approach showed just 2.7% degradation in performance with negligible compression overhead, proving the feasibility of the code compression technique.

Метод мутации сложноструктурированных входных данных при фаззинг-тестировании JavaScript интерпретаторов

Fuzzing of JavaScript engines is one of the most difficult areas in web-browser testing due to the complexity of input data generating. JavaScript engines process JavaScript code on a web page and require constant support for new language standards and increasing complexity in their architecture. The most common fuzzers today are not able to effectively mutate complexly structured input data during fuzzing. Generating JavaScript code from scratch does not allow encapsulating the necessary semantics, and current mutators quickly destroy the syntax and semantics of the input data language. This article presents a new mutation strategy that preserves the syntax and semantics of the input data by modifying the AST of JavaScript code fragments. This method allows you to efficiently generate diverse and correct input data, which can lead to the identification of errors and vulnerabilities in JavaScript engines. This method can be used to improve the security of web browsers and ensure reliable interpretation of JavaScript code.

Juicing V8: A primary account for the memory forensics of the V8 JavaScript engine

V8 is the open source interpreter developed by Google to enable JavaScript (JS) functionality in Chrome and power other software. Malicious threat actors abuse the usage of JS because most modern-day browsers implicitly trust script code to execute. To aid in incident response and memory forensics in such scenarios, our work introduces the first generalizable account of the memory forensics of the V8 JS engine and provides practitioners with a list of objects and their descriptors extracted from a memory image. These objects can be used to reveal key information about a user and their activity. We analyzed the V8 engine and its garbage collection process. We then developed and validated a Volatility plugin – V8MapScan – to reconstruct V8 objects from a memory image. The runtime of the V8 engine is housed within the V8 isolate which contains its own heap manager and garbage collector. Within the heap of the isolate exists a root object map known as the MetaMap. By using the MetaMap and a object-fitting technique, we were able to extract objects, object-maps, and object properties. The V8MapScan plugin scans process memory for the MetaMap data structure contained within the V8 isolate using its data structure, references to objects can be found and extracted. Our findings were verified with Chrome DevTool's Heap Profiler. Our approach recovered the majority of objects indicated by the heap profiler with common types such as the ONE_BYTE_INTERNALIZED_STR type returning more than 98.9%. Lastly, we provide a case study using our tools on the Monero Cryptocurrency Miner.

Wasmati: An efficient static vulnerability scanner for WebAssembly

WebAssembly is a new binary instruction format that allows targeted compiled code written in high-level languages to be executed with near-native speed by the browser’s JavaScript engine. However, given that WebAssembly binaries can be compiled from unsafe languages like C/C++, classical code vulnerabilities such as buffer overflows or format strings can be transferred over from the original programs down to the cross-compiled binaries. As a result, this possibility of incorporating vulnerabilities in WebAssembly modules has widened the attack surface of modern web applications. This paper presents Wasmati, a static analysis tool for finding security vulnerabilities in WebAssembly binaries. It is based on the generation of a code property graph (CPG), a program representation previously adopted for detecting vulnerabilities in various languages but hitherto unapplied to WebAssembly. We formalize the definition of CPG for WebAssembly, introduce techniques to generate CPG for complex WebAssembly, and present four different query specification languages for finding vulnerabilities by traversing a program’s CPG. We implemented ten queries capturing different vulnerability types and extensively tested Wasmati on four heterogeneous datasets. We show that Wasmati can scale the generation of CPGs for large real-world applications and can efficiently find vulnerabilities for all our query types. We have also tested our tool on WebAssembly binaries collected in the wild and identified several potential vulnerabilities, some of which we have manually confirmed to exist unless the enclosing application properly sanitizes the interaction with such affected binaries.

BrowVis: Visualizing Large Graphs in the Browser

A recent stream of research focuses on building high-performance data analysis and management systems that run completely in the browser. Indeed, today personal devices offer non-trivial amount of computing power, while the latest Web browsers provide powerful JavaScript engines. On the other hand, the use of visualization to present and analyze networks is taking a leading role in conveying information and knowledge to users that operate in multiple domains. In this scenario, the aim of our research is to explore the scalability limits of a system that executes the full graph visualization pipeline entirely in the browser. In this paper, we present BrowVis, a self-contained system to compute interactive visualizations of large graphs in the browser. Experiments show that, on a common laptop, BrowVis can visualize graphs with thousands of elements in seconds, as well as graphs with millions of elements in minutes. Once the initial visualization has been computed, BrowVis makes it possible to interactively explore the represented graph by following a details-on-demand paradigm. The use of BrowVis in practice is demonstrated by a case study dealing with a real-world scientific collaboration network.

Audio and Music Analysis on the Web using Essentia.js

Open-source software libraries have a significant impact on the development of Audio Signal Processing and Music Information Retrieval (MIR) systems. Despite the abundance of such tools, there is a lack of an extensive and easy-to-use reference library for audio feature extraction on Web clients. In this article, we present Essentia.js, an open-source JavaScript (JS) library for audio and music analysis on both web clients and JS engines. Along with the Web Audio API, it can be used for both offline and real-time audio feature extraction on web browsers. Essentia.js is modular, lightweight, and easy-to-use, deploy, maintain, and integrate into the existing plethora of JS libraries and web technologies. It is powered by a WebAssembly back end cross-compiled from the Essentia C++ library, which facilitates a JS interface to a wide range of low-level and high-level audio features, including signal processing MIR algorithms as well as pre-trained TensorFlow.js machine learning models. It also provides a higher-level JS API and add-on MIR utility modules along with extensive documentation, usage examples, and tutorials. We benchmark the proposed library on two popular web browsers and the Node.js engine, and four devices, including mobile Android and iOS, comparing it to the native performance of Essentia and the Meyda JS library.

A Review on JavaScript Engine Vulnerability Mining

With the increasing number of web applications on the Internet, the number of clients increases rapidly. Usually, the client will support the execution of JavaScript language. JavaScript engine has become the core part of modern browser to provide dynamic and interactive website. As of July 2018, about 94.9% of websites use JavaScript language [1]. It makes the browser’s JavaScript engine a hot target for attackers. However, due to the characteristics of JavaScript language and inconsistent browser implementation, the vulnerability of JavaScript execution engine has become a major hidden danger of browser security. In this paper, from the composition of JavaScript engine, the common vulnerability forms in the engine, to the existing mainstream engine vulnerability mining tools and methods from dynamic and static perspectives. This paper summarizes the development and existing problems of JavaScript vulnerability mining technology, focuses on the application of fuzzy testing technology in JavaScript vulnerability mining, and analysis the future development trend of JavaScript vulnerability detection combined with existing methods and technologies.

Exposing bugs in JavaScript engines through test transplantation and differential testing

JavaScript is a popular programming language today with several implementations competing for market dominance. Although a specification document and a conformance test suite exist to guide engine development, bugs occur and have important practical consequences. Implementing correct engines is challenging because the spec is intentionally incomplete and evolves frequently. This paper investigates the use of test transplantation and differential testing for revealing functional bugs in JavaScript engines. The former technique runs the regression test suite of a given engine on another engine. The latter technique fuzzes existing inputs and then compares the output produced by different engines with a differential oracle. We conducted experiments with engines from five major players—Apple, Facebook, Google, Microsoft, and Mozilla—to assess the effectiveness of test transplantation and differential testing. Our results indicate that both techniques revealed several bugs, many of which are confirmed by developers. We reported 35 bugs with test transplantation (23 of these bugs confirmed and 19 fixed) and reported 24 bugs with differential testing (17 of these confirmed and 10 fixed). Results indicate that most of these bugs affected two engines—Apple’s JSC and Microsoft’s ChakraCore (24 and 26 bugs, respectively). To summarize, our results show that test transplantation and differential testing are easy to apply and very effective in finding bugs in complex software, such as JavaScript engines.

Platform-Independent Dynamic Taint Analysis for JavaScript

Previous approaches to dynamic taint analysis for JavaScript are implemented directly in a browser or JavaScript engine, limiting their applicability to a single platform and requiring ongoing maintenance as platforms evolve, or they require nontrivial program transformations. We present an approach that relies on instrumentation to encode taint propagation as instructions for an abstract machine. Our approach has two key advantages: it is platform-independent and can be used with any existing JavaScript engine, and it can track taint on primitive values without requiring the introduction of wrapper objects. Furthermore, our technique enables multiple deployment scenarios by varying when and where the generated instructions are executed and it supports indirect taint sources, i.e., situations where taint enters an application via arguments passed to dynamically registered event-listener functions. We implemented the technique for the ECMAScript 5 language in a tool called Ichnaea, and evaluated it on 22 NPM modules containing several types of injection vulnerabilities, including 4 modules containing vulnerabilities that were not previously discovered and reported. On these modules, run-time overheads range from 3.17x to 38.42x, which is significantly better than a previous transformation-based technique. We also report on a case study that shows how Ichnaea can be used to detect privacy leaks in a Tizen web application for the Samsung Gear S2 smart watch.

Mobile web browsing under memory pressure

Mobile devices have become the primary mode of Internet access. Yet, differences in mobile hardware resources, such as device memory, coupled with the rising complexity of Web pages can lead to widely different quality of experience for users. In this work, we analyze how device memory usage affects Web browsing performance. We quantify the memory footprint of popular Web pages over different mobile devices, mobile browsers, and Android versions, analyze the induced memory distribution across different browser components (e.g., JavaScript engine and compositor), investigate how performance gets impacted under memory pressure and propose optimizations to reduce the memory footprint of Web browsing. We show that these optimizations can improve performance and reduce chances of browser crashes in low memory scenarios.

Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing

Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing

ARgent: Web Tabanlı Dinamik İçerik Destekli Artırılmış Gerçeklik Geliştirme Altyapısı

Günümüzün dünyasında insanlar interaktif teknolojilere daha fazla ilgi duyuyor. İnteraktif teknolojilerin en yenilikçi örneklerinden biri olan artırılmış Artırılmış gerçeklik (AG), her ne kadar işe yarasa da, AG uygulamaları geliştirmek programlama ve oyun geliştirme araçları hakkında uzun süren eğitimler sonucu kazanılan bilgi ve tecrübeler gerektiriyor. Diğer yandan tasarım ve içerik oluşturma konusunda yetenekli insanlar, AG uygulaması geliştirmekten ve yönetmekten mahrum kalabiliyor. Bu makalede ARgent, Unity’de geliştirilen bir AR geliştirme aracı tanıtılacaktır. Bu altyapı iş akışının tamamını kapsayan bir yol haritası temin eder ve sunucu, web arayüzü ve mobil uygulama gibi üç ayrı cephede hizmet verir. Sunucu objelerin paketlenmesi ve optimizasyonu, veritabanı yönetimi ve verinin web arayüzü ve mobil arayüze sağlanması gibi görevleri üstlenir. Web arayüzü kullanımı kolay ve herkes tarafından erişilebilir olması neticesiyle bir içerik yönetim sistemi olarak görev görür. Mobil uygulama ise son kullanıcı tarafından kullanılacak uygulamadır. ARgent sadece kullanıcı arayüzünü (GUI) kullanarak ve hiçbir programla yapmaya gerek kalmadan uygulamalar geliştirilmesini sağlayacaktır. Kullanıcılara alışık oldukları bir deneyim sunmak amacıyla, işlemler halihazırda varolan diğer araçlara benzer olacaktır. Unity’de görsellerin dinamik olarak içeri aktarılması sebebiyle ortaya çıkan performans problemleri, ARgent’in sunduğu ve yenilikçi bir yöntem olan “asset bundling” yöntemi ile çözülmüştür. Son olarak, altyapı bir Javascript motoru barındırır ve böylece kullanıcılar kendi betiklerini entegre ederek isteğe göre kullanıcı arayüzü ve nesne davranışı tanılmayabilir.

Energy analysis for internet of things software: A simulator approach

This Letter reports a method to obtain fine-grained energy consumption analysis of programs running on the low-power internet of things (IoT) devices. In the energy estimation domain, most state-of-the-art solutions focus on the coarse-grained approach to monitor the energy consumption of a device or an application. However, few solutions addressed energy monitoring to analyse fine-grained energy consumption of a program, especially for IoT appliances. Therefore, the authors present a fine-grained gem5-based energy profiling tool to help developers to evaluate the energy efficiency of hot spots in their programs. The authors demonstrate its usability by applying it to profiling garbage collection and property lookup in Jerryscript, a JavaScript engine specifically designed for resource-constrained IoT devices, and discover that these two operations are consuming, as they account for 17.67 and 12.26% of total energy, respectively. Therefore, this tool can aid the developers to gain insight into the energy efficiency of their software.

Operational Simulation Environment for SCADA Integration of Renewable Resources

The complexity of power systems is rising mainly due to the expansion of renewable energy generation. Due to the enormous variability and uncertainty associated with these types of resources, they require sophisticated planning tools so that they can be used appropriately. In this sense, several tools for the simulation of renewable energy assets have been proposed. However, they are traditionally focused on the simulation of the generation process, leaving the operation of these systems in the background. Conversely, more expert SCADA operators for the management of renewable power plants are required, but their training is not an easy task. SCADA operation is usually complex, due to the wide set of information available. In this sense, simulation or co-simulation tools can clearly help to reduce the learning curve and improve their skills. Therefore, this paper proposes a useful simulator based on a JavaScript engine that can be easily connected to any renewable SCADAs, making it possible to perform different simulated scenarios for novel operator training, as if it were a real facility. Using this tool, the administrators can easily program those scenarios allowing them to sort out the lack of support found in setting up facilities and training of novel operator tasks. Additionally, different renewable energy generation models that can be implemented in the proposed simulator are described. Later, as a use example of this tool, a study case is also performed. It proposes three different wind farm generation facility models, based on different turbine models: one with the essential generation turbine function obtained from the manufacturer curve, another with an empirical model using monotonic splines, and the last one adding the most important operational states, making it possible to demonstrate the usefulness of the proposed simulation tool.

Segment-Based Multiple-Base Compressed Addressing for Flexible JavaScript Heap Allocation

Many Internet-of-Things (IoT) systems use lightweight JavaScript engines to support easy programming in microcontrollers. Lightweight JavaScript engines use several techniques for memory optimization, such as static heap reservation and compressed addressing. Recent IoT systems also use several external libraries and a larger on-chip memory to support abundant functionalities, such as machine learning and connectivity. However, as the JavaScript heap space is not resizable owing to the memory optimizations, the JavaScript engine or an external library is prone to fail the memory allocation in these devices. To address this problem, we propose a flexible memory optimization technique, segment-based multiple-base compressed addressing (SMBCA) , which compresses a pointer indicating a JavaScript object allocated to a resizable heap based on multiple base addresses. SMBCA comprises two components: a dynamic segment allocator (DSA) and a multiple-base compressed address translator (MBCAT). DSA dynamically allocates the JavaScript heap in segment units. Meanwhile, MBCAT converts a low-bitwidth address into a full-bitwidth address and vice versa, based on the multiple base addresses. To reduce the address compression overhead of MBCAT, we propose a software cache technique, reverse map cache (RMC) . We found that the SMBCA reduces average memory usage by 43.9% compared to the existing lightweight JavaScript engines when running SunSpider benchmarks, V8 benchmarks, and real-world applications. We also showed that the RMC reduces the average address compression latency of MBCAT by 34.9% when running the SunSpider benchmarks.