From b068087bd8fe568f9d18abd3186b051013cc259b Mon Sep 17 00:00:00 2001 From: Kostya Serebryany Date: Tue, 9 May 2017 01:34:27 +0000 Subject: [libFuzzer] update docs on -print_coverage/-dump_coverage llvm-svn: 302498 --- llvm/docs/LibFuzzer.rst | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'llvm/docs/LibFuzzer.rst') diff --git a/llvm/docs/LibFuzzer.rst b/llvm/docs/LibFuzzer.rst index a11baa720ec..5acfa04ce1f 100644 --- a/llvm/docs/LibFuzzer.rst +++ b/llvm/docs/LibFuzzer.rst @@ -305,6 +305,10 @@ The most important command line options are: - 1 : close ``stdout`` - 2 : close ``stderr`` - 3 : close both ``stdout`` and ``stderr``. +``-print_coverage`` + If 1, print coverage information as text at exit. +``-dump_coverage`` + If 1, dump coverage information as a .sancov file at exit. For the full list of flags run the fuzzer binary with ``-help=1``. @@ -543,12 +547,19 @@ You can get the coverage for your corpus like this: .. code-block:: console - ASAN_OPTIONS=coverage=1 ./fuzzer CORPUS_DIR -runs=0 + ./fuzzer CORPUS_DIR -runs=0 -print_coverage=1 This will run all tests in the CORPUS_DIR but will not perform any fuzzing. -At the end of the process it will dump a single ``.sancov`` file with coverage -information. See SanitizerCoverage_ for details on querying the file using the -``sancov`` tool. +At the end of the process it will print text describing what code has been covered and what hasn't. + +Alternatively, use + +.. code-block:: console + + ./fuzzer CORPUS_DIR -runs=0 -dump_coverage=1 + +which will dump a ``.sancov`` file with coverage information. +See SanitizerCoverage_ for details on querying the file using the ``sancov`` tool. You may also use other ways to visualize coverage, e.g. using `Clang coverage `_, -- cgit v1.2.3