Skip to content

doc: Add fuzz based coverage report generation #32206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanofsky merged 1 commit into from
Apr 8, 2025
+41 −0
Merged

doc: Add fuzz based coverage report generation #32206

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions doc/developer-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,6 +575,47 @@ llvm-cov show \

The generated coverage report can be accessed at `build/coverage_report/index.html`.

#### Compiling for Fuzz Coverage

```shell
cmake -B build \
Comment thread
Prabhat1308 marked this conversation as resolved.
Outdated
-DCMAKE_C_COMPILER="clang" \
-DCMAKE_CXX_COMPILER="clang++" \
-DCMAKE_C_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \
-DCMAKE_CXX_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \
-DBUILD_FOR_FUZZING=ON
cmake --build build # Use "-j N" here for N parallel jobs.
```

Running fuzz tests with one or more targets

```shell
# For single target run with the target of choice
LLVM_PROFILE_FILE="$(pwd)/build/raw_profile_data/txorphan.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora txorphan
# If running for multiple targets
LLVM_PROFILE_FILE="$(pwd)/build/raw_profile_data/%m_%p.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora
# Merge profiles
llvm-profdata merge build/raw_profile_data/*.profraw -o build/coverage.profdata
```

Generate report:

```shell
llvm-cov show \
--object=build/bin/fuzz \
-Xdemangler=llvm-cxxfilt \
--instr-profile=build/coverage.profdata \
--ignore-filename-regex="src/crc32c/|src/leveldb/|src/minisketch/|src/secp256k1/|src/test/" \
--format=html \
--show-instantiation-summary \
--show-line-counts-or-regions \
--show-expansions \
--output-dir=build/coverage_report \
--project-title="Bitcoin Core Fuzz Coverage Report"
```

The generated coverage report can be accessed at `build/coverage_report/index.html`.

### Performance profiling with perf

Profiling is a good way to get a precise idea of where time is being spent in
Expand Down