# BoostPolyGlot: A Structured IR Generation-Based Fuzz Testing Framework for GCC Compiler Frontend
## 2 Related Work
### Fuzz Testing Method Based on Mutation  
Unlike generation-based fuzzers, mutation-based fuzzers typically require an initial corpus to operate, generating new test cases through random mutations of existing ones. When a test case triggers a novel execution path that uncovers previously unknown program behavior, it is retained for further mutation. This iterative process enables fuzzers to rapidly explore deeper program states and uncharted execution paths. The fuzzing tool American Fuzzy Lop (AFL) [21] employed coverage feedback to guide random bit-flipping mutations. However, simple bit-flipping often failed grammatical, semantic, and logical checks, resulting in discarded inputs and reduced effectiveness. To address this, modern fuzzers have integrated symbolic execution or taint analysis. [PERSON] [22] generated new test cases from valid inputs and used symbolic execution to explore novel code paths at strategic locations. QSYM [23] optimized hybrid execution through instruction-level symbolic execution, relaxed constraint solving, and basic block trimming to reduce overhead while adjusting inputs to trigger vulnerabilities. Angora [24] solved path constraints without symbolic execution via scalable byte-level taint analysis, context-sensitive branch counting, and gradient descent-based search, and generated high-quality mutants. VUzzer [25] used dynamic taint analysis to identify mutation targets, directing exploration of deeper code paths but lacking runtime-adaptive mutation strategies. To enhance efficiency, researchers have developed optimized feedback-guided approaches. AFLGo [26] introduced directed greybox fuzzing, prioritizing seeds with minimal distance between basic blocks and target points, and outperformed directed whitebox and undirected greybox methods. [PERSON] [27] annotated internal program state data to guide test case mutations. [PERSON] et al. [28] proposed T-Fuzz, a fuzz testing tool that generates test cases based on genetic algorithms. It selects a subset of existing test cases as \"parents\" and generates \"offspring\" through operations such as crossover and mutation. However, in scenarios requiring highly structured input data, for example, adherence to specific file formats or protocol specifications, the aforementioned mutation-based fuzzers may fail to generate valid test cases that meet the requirements. Current fuzzer research emphasizes structural analysis of target programs to produce test cases aligned to such formats or specifications. GRIMORE [29] employed combinatorial operations resembling program syntax structures for large-scale mutations, generating highly structured test cases. Nevertheless, large-scale mutations risk overlooking internal program structural correlations, compromising mutation effectiveness for complex programs. Superior [30] is a grammar-aware coverage-based greybox fuzzing approach that segments test cases prior to mutation while preserving input validity, facilitating deeper fuzzing exploration. [PERSON] et al. [31] constructed JavaScript-specific IRs and used Fuzzilli to generate semantically valid test cases. [PERSON] [32] designed SQL-specific IRs for mutation and semantic analysis, supporting operations such as statement insertion, deletion, and replacement. PolyGlot [33] eliminated syntactic and semantic disparities across programming languages via a unified IR, thereby performing IR mutation and semantic validation to ensure correctness. In generation-based fuzz testing, existing approaches are beset by inherent limitations. For instance, some tools are constrained by specific syntactic rules, thereby lacking adaptability to diverse scenarios and complex operations, and struggling to generate test cases that accommodate varied program characteristics and edge cases. Inadequate consideration of dynamic program states and intricate logic further restricts test case diversity.