  JavaScript (JS) is a popular, platform-independent programming language. To
ensure the interoperability of JS programs across different platforms, the
implementation of a JS engine should conform to the ECMAScript standard.
However, doing so is challenging as there are many subtle definitions of API
behaviors, and the definitions keep evolving.
  We present COMFORT, a new compiler fuzzing framework for detecting JS engine
bugs and behaviors that deviate from the ECMAScript standard. COMFORT leverages
the recent advance in deep learning-based language models to automatically
generate JS test code. As a departure from prior fuzzers, COMFORT utilizes the
well-structured ECMAScript specifications to automatically generate test data
along with the test programs to expose bugs that could be overlooked by the
developers or manually written test cases. COMFORT then applies differential
testing methodologies on the generated test cases to expose standard
conformance bugs. We apply COMFORT to ten mainstream JS engines. In 200 hours
of automated concurrent testing runs, we discover bugs in all tested JS
engines. We had identified 158 unique JS engine bugs, of which 129 have been
verified, and 115 have already been fixed by the developers. Furthermore, 21 of
the Comfort-generated test cases have been added to Test262, the official
ECMAScript conformance test suite.
