diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2017-01-25 22:18:42 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2017-01-27 20:46:18 +0100 |
| commit | 8365c3838dd442ef23f3b622710963382f73f4df (patch) | |
| tree | e981ba6710476e49d059e4d5fd36860d7b778d9e /executor/common.h | |
| parent | 1c190bb96354172fb7589a87a86747f4e06ad605 (diff) | |
all: implement edge coverage
Currently syzkaller uses per-call basic block (BB) coverage.
This change implements edge (not-per-call) coverage.
Edge coverage is more detailed than BB coverage as it captures
not-taken branches, looping, etc. So it provides better feedback signal.
This coverage is now called "signal" throughout the code.
BB code coverage is also collected as it is required for visualisation.
Not doing per-call coverage reduces corpus ~6-7x (from ~35K to ~5K),
this has profound effect on fuzzing efficiency.
Diffstat (limited to 'executor/common.h')
0 files changed, 0 insertions, 0 deletions