# BoostPolyGlot: A Structured IR Generation-Based Fuzz Testing Framework for GCC Compiler Frontend
## 3 Materials and Methods
### IR Mutation Strategy  
During the IR mutation phase, a mutation strategy based on dynamic weight adjustment is adopted to generate test cases with stronger code-coverage capabilities. This strategy first calculates code coverage based on program characteristics and determines the initial weights of mutation types. Subsequently, it employs a fuzzer to monitor and evaluate test cases in real time during the mutation process, constructing a new weight table. Finally, optimal weight values are screened out based on the normalization results of the initial weight table and the outcomes of the new weight table, enabling effective adjustment of the mutation strategy. The specific procedures are as follows:  
First, initial weight allocation is carried out according to the code coverage corresponding to test cases with different program characteristics. Let the test case set be \(IR=\{ir_{1},ir_{2},\cdots,ir_{n}\}\). For each test case \(ir_{i}\), the calculation of code coverage is shown in Equation (5):  
\[Cov(ir_{i})=\alpha\times S(ir_{i})+\beta\times B(ir_{i})+\gamma\times C(ir_{i}) \tag{5}\]  
Here, \(S(ir_{i})\) is the statement-coverage ratio, which represents the ratio of the number of covered statements during the execution of \(ir_{i}\) to the total number of statements in the program. \(B(ir_{i})\) denotes the branch-coverage ratio, namely the ratio of the number of branches covered by \(ir_{i}\) to the total number of branches in the program. \(C(ir_{i})\) is the condition-coverage ratio, serving as a measurement for the coverage of conditional expressions. \((\alpha,\beta,\gamma)\) are corresponding weight coefficients, with \(\alpha+\beta+\gamma=1\), which are used to adjust the weights of different coverage types in the calculation. For each \(type_{j}\)\((j\in[1,m])\) in the mutation type set \(type_{-}set=\{type_{1},type_{2},\cdots,type_{m}\}\), the calculation of its initial weight \(w_{j}^{0}\) is shown in Equation (6):  
\[w_{j}^{0}=\frac{\sum_{i=1}^{n}l(ir_{i},type_{j})\times Cov(ir_{i})}{\sum_{k=1}^ {n}\sum_{j=1}^{n}l(ir_{i},type_{k})\times Cov(ir_{i})} \tag{6}\]Here, \(I(ir_{i},type_{j})\) is an indicator function, used to establish the association between the test case \(ir_{i}\) and the mutation type \(type_{j}\). When the test case contains the characteristics of the mutation type, \(I(ir_{i},type_{j})=1\); otherwise, \(I(ir_{i},type_{j})=0\). The numerator \(\sum_{i=1}^{n}I(ir_{i},type_{j})\times Cov(ir_{i})\) is a weighted sum of the code-coverage rates of all test cases that contain the characteristics of the mutation type \(type_{j}\). Here, the indicator function \(I(ir_{i},type_{j})\) serves as a screening mechanism. Only when the test case \(ir_{i}\) contains the characteristics of the mutation type \(type_{j}\), the code-coverage rate \(Cov(ir_{i})\) of this test case will be included in this summation operation. This means that when calculating the weight of the mutation type \(type_{j}\), only the coverage situations of those test cases that have actually applied this mutation type are taken into account. The denominator \(\sum_{k=1}^{m}\sum_{i=1}^{n}I(ir_{i},type_{k})\times Cov(ir_{i})\) represents a comprehensive summation of the code-coverage rates of test cases corresponding to all mutation types. It traverses all mutation types \(type_{k}\ \ (k\in[1,m])\), as well as all test cases \(ir_{i}\ \ (i\in[1,n])\) under each mutation type, and accumulates the code-coverage rates of test cases that meet the conditions of the corresponding indicator function. Through this calculation method, the resulting initial weight \(w_{j}^{0}\) reflects the relative importance of the mutation type \(type_{j}\) among all mutation types. In practical testing, if a mutation type is applied in test cases that can achieve a relatively high code-coverage rate, then the corresponding weighted sum in the numerator will be large. Given a fixed denominator, the initial weight \(w_{j}^{0}\) of this mutation type will be relatively high.