diff --git a/doc/developer-notes.md b/doc/developer-notes.md index c888a6c0b07..5d0f731bbc8 100644 --- a/doc/developer-notes.md +++ b/doc/developer-notes.md @@ -575,6 +575,47 @@ llvm-cov show \ The generated coverage report can be accessed at `build/coverage_report/index.html`. +#### Compiling for Fuzz Coverage + +```shell +cmake -B build \ + -DCMAKE_C_COMPILER="clang" \ + -DCMAKE_CXX_COMPILER="clang++" \ + -DCMAKE_C_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \ + -DCMAKE_CXX_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \ + -DBUILD_FOR_FUZZING=ON +cmake --build build # Use "-j N" here for N parallel jobs. +``` + +Running fuzz tests with one or more targets + +```shell +# For single target run with the target of choice +LLVM_PROFILE_FILE="$(pwd)/build/raw_profile_data/txorphan.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora txorphan +# If running for multiple targets +LLVM_PROFILE_FILE="$(pwd)/build/raw_profile_data/%m_%p.profraw" ./build/test/fuzz/test_runner.py ../qa-assets/fuzz_corpora +# Merge profiles +llvm-profdata merge build/raw_profile_data/*.profraw -o build/coverage.profdata +``` + +Generate report: + +```shell +llvm-cov show \ + --object=build/bin/fuzz \ + -Xdemangler=llvm-cxxfilt \ + --instr-profile=build/coverage.profdata \ + --ignore-filename-regex="src/crc32c/|src/leveldb/|src/minisketch/|src/secp256k1/|src/test/" \ + --format=html \ + --show-instantiation-summary \ + --show-line-counts-or-regions \ + --show-expansions \ + --output-dir=build/coverage_report \ + --project-title="Bitcoin Core Fuzz Coverage Report" +``` + +The generated coverage report can be accessed at `build/coverage_report/index.html`. + ### Performance profiling with perf Profiling is a good way to get a precise idea of where time is being spent in