Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
fuzz_asm_x86_64 /src/keystone/suite/fuzz/fuzz_asm_x86_64.c 2280 7053 19 201 8433 4902 fuzz_asm_x86_64.c
fuzz_asm_ppc32be /src/keystone/suite/fuzz/fuzz_asm_ppc32be.c 2280 7053 19 201 8433 4902 fuzz_asm_ppc32be.c
fuzz_asm_arm_arm /src/keystone/suite/fuzz/fuzz_asm_arm_arm.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_arm.c
fuzz_asm_mips /src/keystone/suite/fuzz/fuzz_asm_mips.c 2280 7053 19 201 8433 4902 fuzz_asm_mips.c
fuzz_asm_x86_32 /src/keystone/suite/fuzz/fuzz_asm_x86_32.c 2280 7053 19 201 8433 4902 fuzz_asm_x86_32.c
fuzz_asm_mipsbe /src/keystone/suite/fuzz/fuzz_asm_mipsbe.c 2280 7053 19 201 8433 4902 fuzz_asm_mipsbe.c
fuzz_asm_sparc64be /src/keystone/suite/fuzz/fuzz_asm_sparc64be.c 2280 7053 19 201 8433 4902 fuzz_asm_sparc64be.c
fuzz_asm_hex /src/keystone/suite/fuzz/fuzz_asm_hex.c 2280 7053 19 201 8433 4902 fuzz_asm_hex.c
fuzz_asm_riscv64 /src/keystone/suite/fuzz/fuzz_asm_riscv64.c 2280 7053 19 201 8433 4902 fuzz_asm_riscv64.c
fuzz_asm_arm_thumbbe /src/keystone/suite/fuzz/fuzz_asm_arm_thumbbe.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_thumbbe.c
fuzz_asm_arm_armbe /src/keystone/suite/fuzz/fuzz_asm_arm_armbe.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_armbe.c
fuzz_asm_armv8_arm /src/keystone/suite/fuzz/fuzz_asm_armv8_arm.c 2280 7053 19 201 8433 4902 fuzz_asm_armv8_arm.c
fuzz_asm_ppc64be /src/keystone/suite/fuzz/fuzz_asm_ppc64be.c 2280 7053 19 201 8433 4902 fuzz_asm_ppc64be.c
fuzz_asm_x86_16 /src/keystone/suite/fuzz/fuzz_asm_x86_16.c 2280 7053 19 201 8433 4902 fuzz_asm_x86_16.c
fuzz_asm_arm_thumb /src/keystone/suite/fuzz/fuzz_asm_arm_thumb.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_thumb.c
fuzz_asm_evm /src/keystone/suite/fuzz/fuzz_asm_evm.c 2280 7053 19 201 8433 4902 fuzz_asm_evm.c
fuzz_asm_mips64 /src/keystone/suite/fuzz/fuzz_asm_mips64.c 2280 7053 19 201 8433 4902 fuzz_asm_mips64.c
fuzz_asm_ppc64 /src/keystone/suite/fuzz/fuzz_asm_ppc64.c 2280 7053 19 201 8433 4902 fuzz_asm_ppc64.c
fuzz_asm_mips64be /src/keystone/suite/fuzz/fuzz_asm_mips64be.c 2280 7053 19 201 8433 4902 fuzz_asm_mips64be.c
fuzz_asm_arm64_arm /src/keystone/suite/fuzz/fuzz_asm_arm64_arm.c 2280 7053 19 201 8433 4902 fuzz_asm_arm64_arm.c
fuzz_asm_sparcbe /src/keystone/suite/fuzz/fuzz_asm_sparcbe.c 2280 7053 19 201 8433 4902 fuzz_asm_sparcbe.c
fuzz_asm_arm_thumbv8 /src/keystone/suite/fuzz/fuzz_asm_arm_thumbv8.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_thumbv8.c
fuzz_asm_arm_armv8be /src/keystone/suite/fuzz/fuzz_asm_arm_armv8be.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_armv8be.c
fuzz_asm_riscv32 /src/keystone/suite/fuzz/fuzz_asm_riscv32.c 2280 7053 19 201 8433 4902 fuzz_asm_riscv32.c
fuzz_asm_sparc /src/keystone/suite/fuzz/fuzz_asm_sparc.c 2280 7053 19 201 8433 4902 fuzz_asm_sparc.c
fuzz_asm_arm_thumbv8be /src/keystone/suite/fuzz/fuzz_asm_arm_thumbv8be.c 2280 7053 19 201 8433 4902 fuzz_asm_arm_thumbv8be.c
fuzz_asm_systemz /src/keystone/suite/fuzz/fuzz_asm_systemz.c 2280 7053 19 201 8433 4902 fuzz_asm_systemz.c

Fuzzer details

Fuzzer: fuzz_asm_x86_64

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1289 53.2%
gold [1:9] 197 8.13%
yellow [10:29] 4 0.16%
greenyellow [30:49] 4 0.16%
lawngreen 50+ 927 38.2%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
49 49 2 :

['(anonymous namespace)::X86AsmParser::ParseIntelOperator(unsigned int, unsigned int&)', '(anonymous namespace)::X86AsmParser::ParseIntelOffsetOfOperator(unsigned int&)']

57 106 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:1958
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 8 57 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:1972
0 0 5 :

['void llvm_ks::SmallVectorImpl ::emplace_back (llvm_ks::AsmRewriteKind&&, llvm_ks::SMLoc&)', 'llvm_ks::AsmToken::getLoc() const', 'llvm_ks::AsmToken::getString() const', 'llvm_ks::SMLoc::getPointer() const', 'void llvm_ks::SmallVectorImpl ::emplace_back (llvm_ks::AsmRewriteKind&&, llvm_ks::SMLoc&, unsigned int&, long&)']

8 24 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:2007
0 0 None 8 8 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:2035
0 0 None 4 4 ks_open call site: 01355 /src/keystone/llvm/keystone/ks.cpp:477
0 0 2 :

['std::__1::unique_ptr >::unique_ptr (decltype(nullptr))', 'llvm_ks::StringRef::StringRef(char const*)']

4 4 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:2045
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647
0 0 None 0 0 ks_asm call site: 02180 /src/keystone/llvm/keystone/ks.cpp:655

Runtime coverage analysis

Covered functions
2543
Functions that are reachable but not covered
732
Reachable functions
2280
Percentage of reachable functions covered
67.89%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_x86_64.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_ppc32be

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1384 57.1%
gold [1:9] 171 7.06%
yellow [10:29] 7 0.28%
greenyellow [30:49] 3 0.12%
lawngreen 50+ 856 35.3%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
12 12 12 :

['llvm_ks::cast_retty ::ret_type llvm_ks::dyn_cast (llvm_ks::MCExpr const*)', 'llvm_ks::StringRef::StringRef()', 'llvm_ks::AsmToken::getLoc() const', 'llvm_ks::StringRef::StringRef(char const*)', 'memcmp', '(anonymous namespace)::AsmParser::parseExpression(llvm_ks::MCExpr const*&)', 'llvm_ks::MCConstantExpr::getValue() const', 'llvm_ks::MCAsmLexer::is(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCAsmLexer::isNot(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCContext::isValidDwarfFileNumber(unsigned int, unsigned int)', 'llvm_ks::MCAsmParser::getTok() const', 'llvm_ks::AsmToken::getIntVal(bool&) const']

12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3400
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 8 179 ks_open call site: 01353 /src/keystone/llvm/keystone/ks.cpp:453
0 0 None 4 4 ks_open call site: 01352 /src/keystone/llvm/keystone/ks.cpp:447
0 0 1 :

['std::__1::basic_string , std::__1::allocator >::operator=(char const*)']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:242
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_option call site: 01361 /src/keystone/llvm/keystone/ks.cpp:560
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647
0 0 None 0 0 ks_asm call site: 02180 /src/keystone/llvm/keystone/ks.cpp:655
0 0 None 0 0 ks_asm call site: 02192 /src/keystone/llvm/keystone/ks.cpp:667

Runtime coverage analysis

Covered functions
2471
Functions that are reachable but not covered
819
Reachable functions
2280
Percentage of reachable functions covered
64.08%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_ppc32be.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_arm_arm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1307 53.9%
gold [1:9] 177 7.31%
yellow [10:29] 3 0.12%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 934 38.5%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3415
0 0 None 4 175 ks_open call site: 00005 /src/keystone/llvm/keystone/ks.cpp:279
0 0 1 :

['std::__1::basic_string , std::__1::allocator >::operator=(char const*)']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:242
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_option call site: 01361 /src/keystone/llvm/keystone/ks.cpp:560
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647
0 0 None 0 0 ks_asm call site: 02180 /src/keystone/llvm/keystone/ks.cpp:655
0 0 None 0 0 ks_asm call site: 02192 /src/keystone/llvm/keystone/ks.cpp:667
0 0 None 0 0 ks_asm call site: 02349 /src/keystone/llvm/keystone/ks.cpp:674

Runtime coverage analysis

Covered functions
3149
Functions that are reachable but not covered
767
Reachable functions
2280
Percentage of reachable functions covered
66.36%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_arm_arm.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_mips

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1425 58.8%
gold [1:9] 186 7.68%
yellow [10:29] 18 0.74%
greenyellow [30:49] 2 0.08%
lawngreen 50+ 790 32.6%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
74 74 1 :

['(anonymous namespace)::MipsAsmParser::parseSetArchDirective()']

74 74 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5622
60 60 4 :

['std::__1::basic_string , std::__1::allocator >::basic_string()', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'llvm_ks::MCAsmLexer::isNot(llvm_ks::AsmToken::TokenKind) const', '(anonymous namespace)::AsmParser::enterIncludeFile(std::__1::basic_string , std::__1::allocator > const&)']

60 60 (anonymousnamespace)::AsmParser::parseDirectiveInclude() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:4839
42 42 1 :

['(anonymous namespace)::MipsAsmParser::parseSetFpDirective()']

42 42 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5624
25 25 1 :

['(anonymous namespace)::MipsAsmParser::parseDirectiveModuleFP()']

25 25 (anonymousnamespace)::MipsAsmParser::parseDirectiveModule() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5899
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoOddSPRegDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5628
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetMips16Directive()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5642
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoMips16Directive()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5644
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoDspDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5686
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetMsaDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5688
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoMsaDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5690
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetHardFloatDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5694
15 15 1 :

['(anonymous namespace)::MipsAsmParser::parseSetPushDirective()']

15 15 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5632

Runtime coverage analysis

Covered functions
2380
Functions that are reachable but not covered
880
Reachable functions
2280
Percentage of reachable functions covered
61.4%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_mips.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_x86_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1266 52.2%
gold [1:9] 175 7.22%
yellow [10:29] 6 0.24%
greenyellow [30:49] 16 0.66%
lawngreen 50+ 958 39.5%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
60 60 1 :

['(anonymous namespace)::AsmParser::enterIncludeFile(std::__1::basic_string , std::__1::allocator > const&)']

60 60 (anonymousnamespace)::AsmParser::parseDirectiveInclude() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:4854
49 49 2 :

['(anonymous namespace)::X86AsmParser::ParseIntelOperator(unsigned int, unsigned int&)', '(anonymous namespace)::X86AsmParser::ParseIntelOffsetOfOperator(unsigned int&)']

57 106 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:1958
12 12 12 :

['llvm_ks::cast_retty ::ret_type llvm_ks::dyn_cast (llvm_ks::MCExpr const*)', 'llvm_ks::StringRef::StringRef()', 'llvm_ks::AsmToken::getLoc() const', 'llvm_ks::StringRef::StringRef(char const*)', 'memcmp', '(anonymous namespace)::AsmParser::parseExpression(llvm_ks::MCExpr const*&)', 'llvm_ks::MCConstantExpr::getValue() const', 'llvm_ks::MCAsmLexer::is(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCAsmLexer::isNot(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCContext::isValidDwarfFileNumber(unsigned int, unsigned int)', 'llvm_ks::MCAsmParser::getTok() const', 'llvm_ks::AsmToken::getIntVal(bool&) const']

12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3400
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 1 :

['bool std::__1::operator!= , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)']

8 57 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:1974
0 0 5 :

['void llvm_ks::SmallVectorImpl ::emplace_back (llvm_ks::AsmRewriteKind&&, llvm_ks::SMLoc&)', 'llvm_ks::AsmToken::getLoc() const', 'llvm_ks::AsmToken::getString() const', 'llvm_ks::SMLoc::getPointer() const', 'void llvm_ks::SmallVectorImpl ::emplace_back (llvm_ks::AsmRewriteKind&&, llvm_ks::SMLoc&, unsigned int&, long&)']

8 24 (anonymousnamespace)::X86AsmParser::ParseIntelOperand(std::__1::basic_string ,std::__1::allocator >,unsignedint&) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:2007
0 0 None 4 4 ks_open call site: 01355 /src/keystone/llvm/keystone/ks.cpp:477
0 0 None 0 17 (anonymousnamespace)::X86AsmParser::IntelExprStateMachine::onRegister(unsignedint) call site: 00000 /src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp:534
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647

Runtime coverage analysis

Covered functions
2753
Functions that are reachable but not covered
711
Reachable functions
2280
Percentage of reachable functions covered
68.82%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_x86_32.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_mipsbe

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1371 56.6%
gold [1:9] 176 7.26%
yellow [10:29] 16 0.66%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 858 35.4%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
60 60 1 :

['(anonymous namespace)::AsmParser::enterIncludeFile(std::__1::basic_string , std::__1::allocator > const&)']

60 60 (anonymousnamespace)::AsmParser::parseDirectiveInclude() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:4854
25 25 1 :

['(anonymous namespace)::MipsAsmParser::parseDirectiveModuleFP()']

25 25 (anonymousnamespace)::MipsAsmParser::parseDirectiveModule() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5899
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoOddSPRegDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5628
19 19 1 :

['(anonymous namespace)::MipsAsmParser::parseSetSoftFloatDirective()']

19 19 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5692
12 12 12 :

['llvm_ks::cast_retty ::ret_type llvm_ks::dyn_cast (llvm_ks::MCExpr const*)', 'llvm_ks::StringRef::StringRef()', 'llvm_ks::AsmToken::getLoc() const', 'llvm_ks::StringRef::StringRef(char const*)', 'memcmp', '(anonymous namespace)::AsmParser::parseExpression(llvm_ks::MCExpr const*&)', 'llvm_ks::MCConstantExpr::getValue() const', 'llvm_ks::MCAsmLexer::is(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCAsmLexer::isNot(llvm_ks::AsmToken::TokenKind) const', 'llvm_ks::MCContext::isValidDwarfFileNumber(unsigned int, unsigned int)', 'llvm_ks::MCAsmParser::getTok() const', 'llvm_ks::AsmToken::getIntVal(bool&) const']

12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3400
9 9 1 :

['(anonymous namespace)::MipsAsmParser::parseSetMips0Directive()']

9 9 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5652
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
7 7 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoAtDirective()']

7 7 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5618
7 7 1 :

['(anonymous namespace)::MipsAsmParser::parseSetReorderDirective()']

7 7 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5634
7 7 1 :

['(anonymous namespace)::MipsAsmParser::parseSetNoReorderDirective()']

7 7 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5636
7 7 1 :

['(anonymous namespace)::MipsAsmParser::parseSetMacroDirective()']

7 7 (anonymousnamespace)::MipsAsmParser::parseDirectiveSet() call site: 00000 /src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp:5638
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514

Runtime coverage analysis

Covered functions
2647
Functions that are reachable but not covered
813
Reachable functions
2280
Percentage of reachable functions covered
64.34%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_mipsbe.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_sparc64be

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1385 57.2%
gold [1:9] 176 7.26%
yellow [10:29] 15 0.61%
greenyellow [30:49] 3 0.12%
lawngreen 50+ 842 34.7%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 8 179 ks_open call site: 01346 /src/keystone/llvm/keystone/ks.cpp:373
0 0 None 4 4 ks_open call site: 01345 /src/keystone/llvm/keystone/ks.cpp:368
0 0 1 :

['std::__1::basic_string , std::__1::allocator >::operator=(char const*)']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:242
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_option call site: 01361 /src/keystone/llvm/keystone/ks.cpp:560
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647
0 0 None 0 0 ks_asm call site: 02180 /src/keystone/llvm/keystone/ks.cpp:655
0 0 None 0 0 ks_asm call site: 02192 /src/keystone/llvm/keystone/ks.cpp:667
0 0 None 0 0 ks_asm call site: 02349 /src/keystone/llvm/keystone/ks.cpp:674

Runtime coverage analysis

Covered functions
2382
Functions that are reachable but not covered
825
Reachable functions
2280
Percentage of reachable functions covered
63.82%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_sparc64be.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_hex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1360 56.1%
gold [1:9] 188 7.76%
yellow [10:29] 4 0.16%
greenyellow [30:49] 1 0.04%
lawngreen 50+ 868 35.8%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3415
0 0 None 4 175 ks_open call site: 01341 /src/keystone/llvm/keystone/ks.cpp:338
0 0 1 :

['std::__1::basic_string , std::__1::allocator >::operator=(char const*)']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:242
0 0 1 :

['llvm_ks::Target::createMCAsmBackend2(llvm_ks::MCRegisterInfo const&, llvm_ks::StringRef, llvm_ks::StringRef, llvm_ks::MCSubtargetInfo const&, llvm_ks::MCTargetOptions const&) const']

0 5 InitKs(int,ks_struct*,std::__1::basic_string ,std::__1::allocator >) call site: 00000 /src/keystone/llvm/keystone/ks.cpp:247
0 0 None 0 2 interpretDecimal(charconst*,charconst*,decimalInfo*) call site: 00000 /src/keystone/llvm/lib/Support/APFloat.cpp:287
0 0 None 0 0 ks_option call site: 01361 /src/keystone/llvm/keystone/ks.cpp:560
0 0 None 0 0 ks_asm call site: 02168 /src/keystone/llvm/keystone/ks.cpp:647
0 0 None 0 0 ks_asm call site: 02180 /src/keystone/llvm/keystone/ks.cpp:655
0 0 None 0 0 ks_asm call site: 02192 /src/keystone/llvm/keystone/ks.cpp:667
0 0 None 0 0 ks_asm call site: 02349 /src/keystone/llvm/keystone/ks.cpp:674

Runtime coverage analysis

Covered functions
2947
Functions that are reachable but not covered
793
Reachable functions
2280
Percentage of reachable functions covered
65.22%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/keystone/suite/fuzz/fuzz_asm_hex.c 1
/src/keystone/llvm/keystone/ks.cpp 8
/src/keystone/llvm/keystone/ks_priv.h 2
/src/keystone/llvm/include/llvm/Support/SourceMgr.h 22
/src/keystone/llvm/lib/MC/MCTargetOptions.cpp 2
/src/keystone/llvm/include/llvm/MC/MCObjectFileInfo.h 3
/src/keystone/llvm/include/llvm/ADT/Triple.h 25
/src/keystone/llvm/include/llvm/MC/MCTargetOptions.h 2
/src/keystone/llvm/lib/Support/SourceMgr.cpp 10
/src/keystone/llvm/include/llvm/Support/TargetSelect.h 3
/src/keystone/llvm/lib/Target/AArch64/TargetInfo/AArch64TargetInfo.cpp 2
/src/keystone/llvm/lib/Support/TargetRegistry.cpp 4
/src/keystone/llvm/include/llvm/Support/TargetRegistry.h 46
/src/keystone/llvm/lib/Target/ARM/TargetInfo/ARMTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/TargetInfo/HexagonTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Mips/TargetInfo/MipsTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/TargetInfo/PowerPCTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/Sparc/TargetInfo/SparcTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/TargetInfo/SystemZTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/X86/TargetInfo/X86TargetInfo.cpp 1
/src/keystone/llvm/lib/Target/RISCV/TargetInfo/RISCVTargetInfo.cpp 1
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoDarwin.cpp 1
/src/keystone/llvm/lib/MC/MCAsmInfo.cpp 2
/src/keystone/llvm/lib/MC/MCAsmInfoELF.cpp 1
/src/keystone/llvm/lib/MC/MCRegisterInfo.cpp 1
/src/keystone/llvm/include/llvm/MC/MCDwarf.h 6
/src/keystone/llvm/include/llvm/ADT/StringRef.h 10
/src/keystone/llvm/include/llvm/MC/MCAsmInfo.h 9
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenInstrInfo.inc 1
/src/keystone/llvm/include/llvm/MC/MCInstrInfo.h 1
/src/keystone/llvm/include/llvm/MC/MCRegisterInfo.h 7
/src/keystone/llvm/include/llvm/ADT/DenseMap.h 60
/src/keystone/llvm/include/llvm/ADT/EpochTracker.h 3
/src/keystone/llvm/include/llvm/ADT/DenseMapInfo.h 6
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/AArch64/AArch64GenSubtargetInfo.inc 1
/src/keystone/llvm/include/llvm/ADT/ArrayRef.h 22
/src/keystone/llvm/lib/MC/MCSubtargetInfo.cpp 4
/src/keystone/llvm/include/llvm/MC/SubtargetFeature.h 2
/src/keystone/llvm/lib/MC/SubtargetFeature.cpp 12
/src/keystone/llvm/include/llvm/ADT/SmallVector.h 65
/src/keystone/llvm/lib/Support/StringRef.cpp 4
/src/keystone/llvm/lib/Support/SmallVector.cpp 1
/src/keystone/llvm/lib/Support/raw_ostream.cpp 14
/src/keystone/llvm/include/llvm/Support/raw_ostream.h 15
/src/keystone/llvm/include/llvm/Support/Format.h 3
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/MC/MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/AArch64/MCTargetDesc/AArch64AsmBackend.cpp 4
/src/keystone/llvm/include/llvm/MC/MCELFObjectWriter.h 1
/src/keystone/llvm/lib/MC/MCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCAsmInfo.cpp 4
/src/keystone/llvm/lib/MC/MCAsmInfoCOFF.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Support/Triple.cpp 18
/src/keystone/llvm/lib/Support/TargetParser.cpp 9
/src/keystone/llvm/include/llvm/ADT/Twine.h 15
/src/keystone/llvm/lib/Support/Twine.cpp 5
/src/keystone/llvm/include/llvm/ADT/SmallString.h 10
/src/keystone/llvm/lib/Support/ErrorHandling.cpp 3
/src/keystone/llvm/keystone/../lib/Target/ARM/ARMGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMMCCodeEmitter.cpp 3
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.cpp 5
/src/keystone/llvm/keystone/../lib/Target/ARM/MCTargetDesc/ARMAsmBackendELF.h 1
/src/keystone/llvm/lib/Target/ARM/MCTargetDesc/ARMAsmBackend.h 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Hexagon/HexagonGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Hexagon/MCTargetDesc/HexagonAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Mips/MipsGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsMCCodeEmitter.h 1
/src/keystone/llvm/lib/Target/Mips/MCTargetDesc/MipsAsmBackend.cpp 4
/src/keystone/llvm/keystone/../lib/Target/Mips/MCTargetDesc/MipsAsmBackend.h 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCAsmInfo.cpp 2
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/PowerPC/PPCGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCMCCodeEmitter.cpp 2
/src/keystone/llvm/include/llvm/MC/MCContext.h 11
/src/keystone/llvm/lib/Target/PowerPC/MCTargetDesc/PPCAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCTargetDesc.cpp 6
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/Sparc/SparcGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcMCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/Sparc/MCTargetDesc/SparcAsmBackend.cpp 3
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCTargetDesc.cpp 5
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmInfo.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenRegisterInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/SystemZ/SystemZGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/SystemZ/MCTargetDesc/SystemZMCAsmBackend.cpp 2
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp 9
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86AsmBackend.cpp 8
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCAsmInfo.cpp 5
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenRegisterInfo.inc 1
/src/keystone/llvm/include/llvm/Support/MathExtras.h 7
/src/keystone/llvm/keystone/../lib/Target/X86/X86GenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/X86/MCTargetDesc/X86MCCodeEmitter.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCTargetDesc.cpp 7
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCAsmInfo.cpp 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenInstrInfo.inc 1
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenRegisterInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.cpp 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCSubtargetInfo.h 3
/src/keystone/llvm/lib/Target/RISCV/Utils/RISCVBaseInfo.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVMCCodeEmitter.cpp 2
/src/keystone/llvm/keystone/../lib/Target/RISCV/RISCVGenSubtargetInfo.inc 1
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVELFStreamer.cpp 2
/src/keystone/llvm/lib/Target/RISCV/MCTargetDesc/RISCVTargetStreamer.cpp 2
/src/keystone/llvm/lib/MC/MCStreamer.cpp 4
/src/keystone/llvm/include/llvm/MC/MCStreamer.h 3
/src/keystone/llvm/include/llvm/MC/MCObjectStreamer.h 1
/src/keystone/llvm/include/llvm/MC/MCAssembler.h 4
/src/keystone/llvm/keystone/../lib/Target/RISCV/MCTargetDesc/RISCVAsmBackend.h 1
/src/keystone/llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp 1
/src/keystone/llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Hexagon/AsmParser/HexagonAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Mips/AsmParser/MipsAsmParser.cpp 1
/src/keystone/llvm/lib/Target/PowerPC/AsmParser/PPCAsmParser.cpp 1
/src/keystone/llvm/lib/Target/Sparc/AsmParser/SparcAsmParser.cpp 1
/src/keystone/llvm/lib/Target/SystemZ/AsmParser/SystemZAsmParser.cpp 1
/src/keystone/llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp 1
/src/keystone/llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp 1
/src/keystone/llvm/include/llvm/ADT/STLExtras.h 1
/src/keystone/llvm/include/llvm/ADT/iterator_range.h 4
/src/keystone/llvm/include/llvm/MC/MCAsmBackend.h 1
/src/keystone/llvm/include/llvm/MC/MCTargetOptionsCommandFlags.h 1
/src/keystone/llvm/keystone/EVMMapping.cpp 1
/src/keystone/llvm/lib/MC/MCContext.cpp 12
/src/keystone/llvm/include/llvm/Support/Allocator.h 21
/src/keystone/llvm/include/llvm/ADT/StringMap.h 29
/src/keystone/llvm/include/llvm/MC/MCCodeView.h 1
/src/keystone/llvm/include/llvm/ADT/SetVector.h 3
/src/keystone/llvm/include/llvm/ADT/DenseSet.h 5
/src/keystone/llvm/lib/Support/Unix/Path.inc 4
/src/keystone/llvm/include/llvm/Support/FileSystem.h 5
/src/keystone/llvm/lib/Support/Path.cpp 9
/src/keystone/llvm/include/llvm/Support/Path.h 4
/usr/include/x86_64-linux-gnu/sys/stat.h 1
/src/keystone/llvm/include/llvm/Support/AlignOf.h 3
/src/keystone/llvm/lib/MC/MCObjectFileInfo.cpp 5
/src/keystone/llvm/include/llvm/MC/SectionKind.h 13
/src/keystone/llvm/lib/Support/StringMap.cpp 3
/src/keystone/llvm/include/llvm/ADT/StringExtras.h 1
/src/keystone/llvm/lib/MC/MCSymbol.cpp 1
/src/keystone/llvm/include/llvm/MC/MCSymbolCOFF.h 1
/src/keystone/llvm/include/llvm/MC/MCSymbol.h 7
/src/keystone/llvm/include/llvm/ADT/PointerIntPair.h 5
/src/keystone/llvm/include/llvm/MC/MCSymbolELF.h 2
/src/keystone/llvm/include/llvm/MC/MCSymbolMachO.h 1
/src/keystone/llvm/lib/MC/MCSectionMachO.cpp 1
/src/keystone/llvm/lib/MC/MCSection.cpp 2
/src/keystone/llvm/include/llvm/MC/MCFragment.h 2
/src/keystone/llvm/lib/MC/MCFragment.cpp 3
/src/keystone/llvm/include/llvm/ADT/ilist_node.h 6
/src/keystone/llvm/include/llvm/MC/MCSection.h 1
/src/keystone/llvm/include/llvm/ADT/ilist.h 17
/src/keystone/llvm/include/llvm/MC/MCSectionCOFF.h 1
/src/keystone/llvm/include/llvm/Support/Casting.h 9
/src/keystone/llvm/include/llvm/MC/MCSectionELF.h 1
/src/keystone/llvm/lib/MC/MCSymbolELF.cpp 1
/src/keystone/llvm/lib/MC/MCELFStreamer.cpp 1
/src/keystone/llvm/include/llvm/MC/MCELFStreamer.h 1
/src/keystone/llvm/lib/MC/MCObjectStreamer.cpp 1
/src/keystone/llvm/lib/MC/MCAssembler.cpp 1
/src/keystone/llvm/include/llvm/ADT/SmallPtrSet.h 6
/src/keystone/llvm/lib/Support/SmallPtrSet.cpp 1
/src/keystone/llvm/include/llvm/MC/MCLinkerOptimizationHint.h 1
/src/keystone/llvm/include/llvm/MC/MCWinEH.h 1
/src/keystone/llvm/lib/Support/MemoryBuffer.cpp 4
/src/keystone/llvm/include/llvm/Support/MemoryBuffer.h 5
/src/keystone/llvm/include/llvm/Support/ErrorOr.h 7
/src/keystone/llvm/include/llvm/Support/SMLoc.h 3
/src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmParser.cpp 3
/src/keystone/llvm/lib/MC/MCParser/AsmLexer.cpp 3
/src/keystone/llvm/lib/MC/MCParser/MCAsmLexer.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/MCAsmLexer.h 3
/src/keystone/llvm/include/llvm/ADT/APInt.h 6
/src/keystone/llvm/lib/Support/APInt.cpp 2
/src/keystone/llvm/include/llvm/MC/MCParser/AsmCond.h 1
/src/keystone/llvm/lib/MC/MCParser/DarwinAsmParser.cpp 2
/src/keystone/llvm/lib/MC/MCParser/MCAsmParserExtension.cpp 1

Fuzzer: fuzz_asm_riscv64

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1332 55.0%
gold [1:9] 175 7.22%
yellow [10:29] 13 0.53%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 901 37.2%
All colors 2421 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
7 7 1 :

['EVM_opcode(char const*)']

7 7 ks_asm call site: 01368 /src/keystone/llvm/keystone/ks.cpp:617
4 4 2 :

['operator delete(void*)', 'ks_struct::~ks_struct()']

4 4 ks_open call site: 01357 /src/keystone/llvm/keystone/ks.cpp:514
0 0 None 12 12 (anonymousnamespace)::AsmParser::parseDirectiveLoc() call site: 00000 /src/keystone/llvm/lib/MC/MCParser/AsmParser.cpp:3415
0 0 None 4 4 ks_open call site: 01348