# BoostPolyGlot: A Structured IR Generation-Based Fuzz Testing Framework for GCC Compiler Frontend
## 3 Materials and Methods
### Structured Program Characteristics IR Extraction  
To enhance the code coverage of test cases, this study employs the IR node set derived from translating structured program cases using the main IR translator as the foundational data source. It systematically extracts IR nodes with structured program characteristics, including loop structures and dependency relationships, which serve as insertion nodes for test cases. When extracting IR nodes with loop structures, the following steps are carried out. First, the IR nodes marking the start and end of the loop are identified to determine the loop scope. Then, for the expression nodes of the loop condition, by examining the changes of variables in the expression and the types of conditional operators, the boundary values and changing trends of the number of loop executions under different test scenarios are determined. Meanwhile, an analysis is conducted to check if there is a potential risk of an infinite loop caused by complex conditions. Regarding the loop variable nodes, it is necessary to track their definition nodes, initialization nodes, and update nodes in the program. The definition node represents the position and basic type information of the loop variable in the program structure. The initialization node indicates the initial value of the loop variable participating in operations, and the update node reflects its changing pattern in each loop iteration. Through the analysis of these nodes, the changing range of the loop variable is determined. Finally, the nodes performing operations inside the loop  
Figure 2: An example IR program with its corresponding BNF grammar and semantic annotations. (**a**) Part of the BNF grammar for C programs. (**b**) Part of semantic annotations for the BNF grammar. (**c**) An example IR program after conversion by master–slave IR translation. body are analyzed to identify the relevant nodes that change according to the loop variable or the loop condition. These nodes related to the loop structure are then extracted. Assume that the IR node set translated by the main IR translator is denoted as \(IR=\{ir_{0},ir_{1},ir_{2},\ldots,ir_{n}\}\). Each \(ir_{i}\) (\(0\leq i\leq n\)) represents an independent IR node, encompassing various semantic and structural information of the program at the IR level. Meanwhile, the ancestor node of all ir nodes with structured program characteristics (which need to be extracted) is defined as \(ir_{pa}\). The feature judgment function \(f(ir_{i})\) for each node \(ir_{i}\) in the set IR is defined, as shown in Equation (1):  
\[f(ir_{i})= \begin{cases}1,&ir_{i}\subseteq ir_{pa}\\ 0,&\text{else}\end{cases}  \tag{1}\]  
When extracting IR nodes with dependency relationships, the following steps are taken. First, program variables and their operational logic are determined by analyzing the roles of function parameters in variable assignment and expression construction, as well as the usage patterns of function return values, thereby identifying dependency relationships among program elements. Second, a dependency relationship graph is constructed using program nodes as vertices and dependency relationships as edges, which intuitively presents the program's dependency structure. Finally, nodes on dependency paths are extracted based on the dependency relationship graph. These nodes include those directly embodying dependency relationships and those related to variable type declarations and initialization value settings, ensuring the complete extraction of all elements associated with dependency relationships. The extraction algorithm for IR nodes with structured program characteristics is shown in Algorithm 1. ```
Input: Array \(ir\_set\) Output: The array to be extracted \(extracted\_array\)
1. begin
2. int \(count\gets ir\_set.size()\);// Statistical \(ir\_set\) array length
3. \(main\_value\leftarrow ir\_set[start]\);//\(start\) is the entry of the node to be extracted
4. end_value \(\leftarrow ir\_set[end]\);//\(end\) is the end node of the node to be extracted
5. for\(i=0\) to \(count\)
6.