$ git clone https://github.com/tarantool/tarantool
$ cd tarantool
$ git clone https://github.com/ligurio/tarantool-corpus test/static
$ CC=clang CXX=clang++ cmake -S . -B build -G Ninja -DENABLE_FUZZER=ON -DENABLE_UB_SANITIZER=ON
$ cmake --build build/ --parallel --target fuzzers$ ctest --test-dir build -L fuzzing
$ ./build/test/fuzz/lua_fuzzer/lua_fuzzer -set_cover_merge=1 corpus new_corpus
$ ./build/test/fuzz/lua_fuzzer/lua_fuzzer -merge=1 corpus new_corpusCompile and link with -fprofile-instr-generate -fcoverage-mapping options. When
using -fsanitize=address, no .profraw will be written on crash or abort, so
once the fuzzing test is finished, a second run is needed by passing only files
in corpus, run: ./fuzzer -runs=0 ./corpora_minimized:
$ CFLAGS="-fprofile-instr-generate -fcoverage-mapping" CC=clang CXX=clang++ cmake -S . -B build -G Ninja -DENABLE_FUZZER=ON
$ cmake --build build --parallel
$ ./build/test/fuzz/http_parser_fuzzer -runs=0
Then to generate an html view:
$ llvm-profdata merge -sparse default.profraw -o default.profdata
$ llvm-cov show --format=html ./build/src/tarantool -instr-profile=default.profdata > coverage.htmlShow code coverage for a single function with a name http_parser:
$ llvm-cov show ./build/src/tarantool -instr-profile=default.profdata -name=http_parser