search

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.52k stars 2.23k forks source link

100% region and function coverage but 60% line coverage #5295

Open ghost opened 3 years ago

ghost commented 3 years ago

I have one file that has coverage

60.67% (54/89) 100.00% (1/1) 100.00% (41/41)

according to the Coverage Report. Looking at the source file and the indication of calls per line shows that the file is pretty much 100% line covered too? What am I missing? I can't get the line coverage up.

jonathanmetzman commented 3 years ago

Can you link to this file? Could be a bug. Or maybe something weird going on with macros.

ghost commented 3 years ago

https://storage.googleapis.com/oss-fuzz-coverage/uwebsockets/reports/20210303/linux/src/uWebSockets/src/QueryParser.h.html

I've had similar problems with other inline functions but it doesn't look like any one instantiation of it would be missing coverage - not according to the number of executions per line shown?

ghost commented 3 years ago

There are only 54 lines of code and all of them have coverage. So how can it only be 60% covered?

jonathanmetzman commented 3 years ago

This definitely looks like a bug in LLVM's coverage tooling to me. I don't know if we have the cycles to fix this. I suspect it only happens with inline functions so hopefully it isn't common enough to adversely impact many users.

ghost commented 3 years ago

Great! Yeah I don't care I just thought it was strange. Should this be reported to LLVM or just ignored?

jonathanmetzman commented 3 years ago

Probably, but the reproducer will be pretty non-minimal here (ie: 1. do coverage build of uwebsockets 2. Do coverage run of all fuzzers. 3. Merge profdata files. 4. Generate report). @morehouse What do you think?

morehouse commented 3 years ago

I think the bug is unlikely to be fixed upstream without a small reproducer.