From: Kostya Serebryany Date: Thu, 5 May 2016 18:07:09 +0000 (+0000) Subject: [libFuzzer] better docs for coverage X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b69177e91e52d6970214fb95a618146d57f1813c;p=llvm [libFuzzer] better docs for coverage git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268656 91177308-0d34-0410-b5e6-96231b3b80d8 --- diff --git a/docs/LibFuzzer.rst b/docs/LibFuzzer.rst index 015b7ef87ae..529a99df87b 100644 --- a/docs/LibFuzzer.rst +++ b/docs/LibFuzzer.rst @@ -598,12 +598,15 @@ You can get the coverage for your corpus like this: .. code-block:: console - ASAN_OPTIONS=coverage=1 ./fuzzer CORPUS_DIR -runs=0 + ASAN_OPTIONS=coverage=1:html_cov_report=1 ./fuzzer CORPUS_DIR -runs=0 -This will run all the tests in the CORPUS_DIR but will not generate any new tests -and dump covered PCs to disk before exiting. -Then you can subtract the set of covered PCs from the set of all instrumented PCs in the binary, -see SanitizerCoverage_ for details. +This will run all tests in the CORPUS_DIR but will not perform any fuzzing. +At the end of the process it will dump a single html file with coverage information. +See SanitizerCoverage_ for details. + +You may also use other ways to visualize coverage, +e.g. `llvm-cov `_, but those will require +you to rebuild the code with different compiler flags. User-supplied mutators ----------------------