  We present LeJit, a template-based framework for testing Java just-in-time
(JIT) compilers. Like recent template-based frameworks, LeJit executes a
template -- a program with holes to be filled -- to generate concrete programs
given as inputs to Java JIT compilers. LeJit automatically generates template
programs from existing Java code by converting expressions to holes, as well as
generating necessary glue code (i.e., code that generates instances of
non-primitive types) to make generated templates executable. We have
successfully used LeJit to test a range of popular Java JIT compilers,
revealing five bugs in HotSpot, nine bugs in OpenJ9, and one bug in GraalVM.
All of these bugs have been confirmed by Oracle and IBM developers, and 11 of
these bugs were previously unknown, including two CVEs (Common Vulnerabilities
and Exposures). Our comparison with several existing approaches shows that
LeJit is complementary to them and is a powerful technique for ensuring Java
JIT compiler correctness.
