Just-in-time (JIT) compilers are key components for many popular
programming languages with managed runtimes (e.g., Java and
JavaScript). JIT compilers perform optimizations and generate native
code at runtime based on dynamic profiling data, to improve the
execution performance of the running application. Like other software
systems, JIT compilers might have software bugs, and prior work has
developed a number of automated techniques for detecting functional
bugs (i.e., generated native code does not semantically match that of
the original code). However, no prior work has targeted JIT compiler
performance bugs, which can cause significant performance degradation
while an application is running. These performance bugs are
challenging to detect due to the complexity and dynamic nature of JIT
compilers. In this paper, we present the first work on demystifying
JIT performance bugs. First, we perform an empirical study across four
popular JIT compilers for Java and JavaScript. Our manual analysis of
191 bug reports uncovers common triggers of performance bugs, patterns
in which these bugs manifest, and their root causes. Second, informed
by these insights, we propose layered differential performance
testing, a lightweight technique to automatically detect JIT compiler
performance bugs, and implement it in a tool called Jittery. We
incorporate practical optimizations into Jittery such as test
prioritization, which reduces testing time by 92.40% without
compromising bug-detection capability, and automatic filtering of
false-positives and duplicates, which substantially reduces manual
inspection effort. Using Jittery, we discovered 12 previously unknown
performance bugs in the Oracle HotSpot and Graal JIT compilers, with
11 confirmed and 6 fixed by developers.