@@ -575,6 +575,47 @@ llvm-cov show \
575
575
576
576
The generated coverage report can be accessed at ` build/coverage_report/index.html ` .
577
577
578
+ #### Compiling for Fuzz Coverage
579
+
580
+ ``` shell
581
+ cmake -B build \
582
+ -DCMAKE_C_COMPILER=" clang" \
583
+ -DCMAKE_CXX_COMPILER=" clang++" \
584
+ -DCMAKE_C_FLAGS=" -fprofile-instr-generate -fcoverage-mapping" \
585
+ -DCMAKE_CXX_FLAGS=" -fprofile-instr-generate -fcoverage-mapping" \
586
+ -DBUILD_FOR_FUZZING=ON
587
+ cmake --build build # Use "-j N" here for N parallel jobs.
588
+ ```
589
+
590
+ Running fuzz tests with one or more targets
591
+
592
+ ``` shell
593
+ # For single target run with the target of choice
594
+ LLVM_PROFILE_FILE=" $( pwd) /build/raw_profile_data/txorphan.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora txorphan
595
+ # If running for multiple targets
596
+ LLVM_PROFILE_FILE=" $( pwd) /build/raw_profile_data/%m_%p.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora
597
+ # Merge profiles
598
+ llvm-profdata merge build/raw_profile_data/* .profraw -o build/coverage.profdata
599
+ ```
600
+
601
+ Generate report:
602
+
603
+ ``` shell
604
+ llvm-cov show \
605
+ --object=build/bin/fuzz \
606
+ -Xdemangler=llvm-cxxfilt \
607
+ --instr-profile=build/coverage.profdata \
608
+ --ignore-filename-regex=" src/crc32c/|src/leveldb/|src/minisketch/|src/secp256k1/|src/test/" \
609
+ --format=html \
610
+ --show-instantiation-summary \
611
+ --show-line-counts-or-regions \
612
+ --show-expansions \
613
+ --output-dir=build/coverage_report \
614
+ --project-title=" Bitcoin Core Fuzz Coverage Report"
615
+ ```
616
+
617
+ The generated coverage report can be accessed at ` build/coverage_report/index.html ` .
618
+
578
619
### Performance profiling with perf
579
620
580
621
Profiling is a good way to get a precise idea of where time is being spent in
0 commit comments