Current fuzzers for JavaScript (JS) engines often produce test cases that are syntactically correct but semantically incorrect, hindering efficient crash discovery. To address this issue, we propose three mutation methods: simple mutation, state mutation, and Just-In-Time (JIT) compilation optimization triggering. The combination of these methods significantly increases the variety of seed mutations, distinguishing our approach from other fuzzers. Additionally, we analyze each JS engine to identify conditions that trigger JIT optimization, incorporating these conditions into the mutation methods to enhance path coverage. This approach achieves over 20% branch coverage, at least 5% higher than other fuzzers, with a semantic correctness rate above 80%, reducing time wasted on semantic errors. Finally, our method nearly doubles the crash discovery rate compared to other fuzzers.