Node.fz: Fuzzing the Server-Side Event-Driven Architecture

The importance of the Event-Driven Architecture (EDA) has never been greater. Web servers and the IoT alike have begun to adopt the EDA, and the popular server-side EDA framework, Node.js, boasts the world's largest package ecosystem. While multi-threaded programming has been well studied in the literature, concurrency bug characteristics and useful development tools remain largely unexplored for server-side EDA-based applications. We present the first (to the best of our knowledge) concurrency bug characteristic study of real world open-source event-driven applications, based in Node.js. Like multithreaded programs, event-driven programs are prone to concurrency bugs like atomicity violations and order violations. Our study shows the forms that atomicity violations and ordering violations take in the EDA context, and points out the limitations of existing concurrency error detection tools developed for client-side EDA applications. Based on our bug study, we propose Node.fz, a novel testing aid for server-side event-driven programs. Node.fz is a schedule fuzzing test tool for event-driven programs, embodied for server-side Node.js programs. Node.fz randomly perturbs the execution of a Node.js program, allowing Node.js developers to explore a variety of possible schedules. Thanks to its low overhead, Node.fz enables a developer to explore a broader "schedule space" with the same test time budget, ensuring that applications will be stable in a wide variety of deployment conditions. We show that Node.fz can expose known bugs much more frequently than vanilla Node.js, and that it can uncover new bugs.