High level conclusions

Fuzzers reach 26.18% of cyclomatic complexity.

Fuzzers reach 25.57% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

579 / 2264

Cyclomatic complexity statically reachable by fuzzers

5108 / 19511

Runtime code coverage of functions

481 / 2264

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libpsl_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	2.35%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	1.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	82	96.4%
All colors	85	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	26	183	psl_load_fp	call site: 00002	/src/libpsl/src/psl.c:1192
0	0	None	24	181	psl_load_fp	call site: 00003	/src/libpsl/src/psl.c:1195
0	0	None	10	187	is_public_suffix	call site: 00049	/src/libpsl/src/psl.c:849
0	0	None	8	116	is_public_suffix	call site: 00051	/src/libpsl/src/psl.c:864
0	0	None	6	18	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1212
0	0	None	6	18	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1220
0	0	None	4	190	psl_load_file	call site: 00081	/src/libpsl/src/psl.c:1160
0	0	None	2	2	vector_add	call site: 00023	/src/libpsl/src/psl.c:254
0	0	None	0	0	is_public_suffix	call site: 00049	/src/libpsl/src/psl.c:841
0	0	None	0	0	is_public_suffix	call site: 00054	/src/libpsl/src/psl.c:886
0	0	None	0	0	is_public_suffix	call site: 00072	/src/libpsl/src/psl.c:906
0	0	None	0	0	is_public_suffix	call site: 00074	/src/libpsl/src/psl.c:925

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

15

Reachable functions

52

Percentage of reachable functions covered

71.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	13.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	1.03%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	85.5%
All colors	97	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

17

Reachable functions

60

Percentage of reachable functions covered

71.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	30
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	8.23%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	1.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	77	90.5%
All colors	85	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

15

Reachable functions

52

Percentage of reachable functions covered

71.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	36	37.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.03%
lawngreen	50+	60	61.8%
All colors	97	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
151	155	12 : View List ['fgets', 'add_punycode_if_needed', 'vector_alloc', 'isspace_ascii', 'psl_idna_close', 'vector_find', 'vector_sort', 'psl_idna_open', 'vector_get', 'suffix_init', 'strstr', 'vector_add']	151	155	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1204
0	0	None	167	183	psl_load_fp	call site: 00004	/src/libpsl/src/psl.c:1192
0	0	None	165	181	psl_load_fp	call site: 00005	/src/libpsl/src/psl.c:1195
0	0	None	163	179	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1199
0	0	None	34	187	is_public_suffix	call site: 00051	/src/libpsl/src/psl.c:849
0	0	None	32	116	is_public_suffix	call site: 00053	/src/libpsl/src/psl.c:864
0	0	None	6	18	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1212
0	0	None	6	18	psl_load_fp	call site: 00010	/src/libpsl/src/psl.c:1220
0	0	None	0	10	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1209
0	0	None	0	7	punycode_encode	call site: 00035	/src/libpsl/src/psl.c:440
0	0	None	0	7	punycode_encode	call site: 00035	/src/libpsl/src/psl.c:456
0	0	None	0	7	punycode_encode	call site: 00035	/src/libpsl/src/psl.c:482

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

29

Reachable functions

60

Percentage of reachable functions covered

51.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	30
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	65.4%
gold	[1:9]	9	10.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	20	23.8%
All colors	84	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
173	173	3 : View List ['strlen', 'strchr', 'is_public_suffix']	173	173	psl_registrable_domain	call site: 00052	/src/libpsl/src/psl.c:1112
0	0	None	173	173	psl_unregistrable_domain	call site: 00048	/src/libpsl/src/psl.c:1058
0	0	None	169	169	psl_is_public_suffix	call site: 00003	/src/libpsl/src/psl.c:992
0	0	None	169	169	psl_is_public_suffix2	call site: 00043	/src/libpsl/src/psl.c:1027
0	0	None	15	193	psl_is_cookie_domain_acceptable	call site: 00056	/src/libpsl/src/psl.c:1644
0	0	None	6	9	psl_str_to_utf8lower	call site: 00066	/src/libpsl/src/psl.c:1720
0	0	None	4	4	psl_str_to_utf8lower	call site: 00068	/src/libpsl/src/psl.c:1728
0	0	None	0	0	psl_builtin_outdated	call site: 00080	/src/libpsl/src/psl.c:1510
0	0	None	0	0	psl_check_version_number	call site: 00076	/src/libpsl/src/psl.c:1570

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

32

Reachable functions

49

Percentage of reachable functions covered

34.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	26	30.9%
gold	[1:9]	3	3.57%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	55	65.4%
All colors	84	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

9

Reachable functions

49

Percentage of reachable functions covered

81.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl_idn_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	57	33.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.58%
lawngreen	50+	114	66.2%
All colors	172	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
151	155	12 : View List ['fgets', 'add_punycode_if_needed', 'vector_alloc', 'isspace_ascii', 'psl_idna_close', 'vector_find', 'vector_sort', 'psl_idna_open', 'vector_get', 'suffix_init', 'strstr', 'vector_add']	151	155	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1204
0	0	None	167	183	psl_load_fp	call site: 00004	/src/libpsl/src/psl.c:1192
0	0	None	165	181	psl_load_fp	call site: 00005	/src/libpsl/src/psl.c:1195
0	0	None	163	179	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1199
0	0	None	34	187	is_public_suffix	call site: 00126	/src/libpsl/src/psl.c:849
0	0	None	32	116	is_public_suffix	call site: 00128	/src/libpsl/src/psl.c:864
0	0	None	12	353	idna_to_ascii_4z	call site: 00109	/src/libidn/lib/idna.c:537
0	0	None	8	130	_g_utf8_normalize_wc	call site: 00057	/src/libidn/lib/nfkc.c:784
0	0	None	8	130	_g_utf8_normalize_wc	call site: 00059	/src/libidn/lib/nfkc.c:794
0	0	None	6	310	stringprep	call site: 00051	/src/libidn/lib/stringprep.c:435
0	0	None	6	18	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1212
0	0	None	6	18	psl_load_fp	call site: 00010	/src/libpsl/src/psl.c:1220

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

35

Reachable functions

88

Percentage of reachable functions covered

60.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	25
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	4.34%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.62%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	153	95.0%
All colors	161	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

20

Reachable functions

80

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	19
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_idn_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	4.34%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.62%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	153	95.0%
All colors	161	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	26	183	psl_load_fp	call site: 00002	/src/libpsl/src/psl.c:1192
0	0	None	24	181	psl_load_fp	call site: 00003	/src/libpsl/src/psl.c:1195
0	0	None	12	353	idna_to_ascii_4z	call site: 00108	/src/libidn/lib/idna.c:537
0	0	None	10	187	is_public_suffix	call site: 00125	/src/libpsl/src/psl.c:849
0	0	None	8	116	is_public_suffix	call site: 00127	/src/libpsl/src/psl.c:864
0	0	None	6	310	stringprep	call site: 00050	/src/libidn/lib/stringprep.c:435
0	0	None	6	18	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1212
0	0	None	6	18	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1220
0	0	None	4	645	idna_to_ascii_4i	call site: 00043	/src/libidn/lib/idna.c:141
0	0	None	4	190	psl_load_file	call site: 00157	/src/libpsl/src/psl.c:1160
0	0	None	4	12	stringprep	call site: 00085	/src/libidn/lib/stringprep.c:454
0	0	None	2	51	idna_to_ascii_4i	call site: 00093	/src/libidn/lib/idna.c:158

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

20

Reachable functions

80

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	19
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	7.55%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.58%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	158	91.8%
All colors	172	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

22

Reachable functions

88

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	25
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_idn_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	55.3%
gold	[1:9]	11	4.50%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	98	40.1%
All colors	244	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
71	71	3 : View List ['psl_idna_open', 'psl_idna_toASCII', 'psl_idna_close']	105	187	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:861
24	24	2 : View List ['vector_get', 'vector_find']	28	28	is_public_suffix	call site: 00094	/src/libpsl/src/psl.c:880
6	6	2 : View List ['malloc', '__errno_location']	8	20	u8_normalize	call site: 00211	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00186	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['malloc', 'realloc']	8	12	libunistring_u8_casemap	call site: 00185	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00213	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
0	0	None	36	132	u8_normalize	call site: 00186	/src/libunistring/lib/uninorm/u-normalize-internal.h:37
0	0	None	36	132	u8_normalize	call site: 00201	/src/libunistring/lib/uninorm/u-normalize-internal.h:254
0	0	None	34	355	libunistring_u8_casemap	call site: 00154	/src/libunistring/lib/unicase/u-casemap.h:42
0	0	None	34	355	libunistring_u8_casemap	call site: 00159	/src/libunistring/lib/unicase/u-casemap.h:125
0	0	None	34	355	libunistring_u8_casemap	call site: 00172	/src/libunistring/lib/unicase/u-casemap.h:238
0	0	None	34	355	libunistring_u8_casemap	call site: 00172	/src/libunistring/lib/unicase/u-casemap.h:248

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

59

Reachable functions

104

Percentage of reachable functions covered

43.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	25
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libunistring/lib/unistr/u8-strlen.c	1

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	65	26.6%
gold	[1:9]	3	1.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	176	72.1%
All colors	244	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

24

Reachable functions

104

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	25
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libunistring/lib/unistr/u8-strlen.c	1

Fuzzer: libpsl_idn2_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	226	71.9%
All colors	314	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6	924	9 : View List ['map_is', 'malloc', 'u32_normalize', '_idn2_label_test', 'get_idna_map', 'get_map_data', '_idn2_punycode_decode_internal', 'u32_to_u8', '__errno_location']	6	964	_tr46	call site: 00128	/src/libidn2/lib/lookup.c:292
6	6	2 : View List ['malloc', '__errno_location']	8	20	u8_normalize	call site: 00087	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00153	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00063	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['malloc', 'realloc']	8	12	libunistring_u8_casemap	call site: 00062	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00175	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00153	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00091	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00164	/src/libunistring/lib/unistr/u32-to-u8.c:111
2	2	2 : View List ['malloc', '__errno_location']	2	2	u8_to_u32	call site: 00115	/src/libunistring/lib/unistr/u8-to-u32.c:100
0	10	1 : View List ['_idn2_contextj_p']	43	215	_idn2_label_test	call site: 00187	/src/libidn2/lib/idna.c:195

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

28

Reachable functions

119

Percentage of reachable functions covered

76.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	18
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	40.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	191	58.7%
All colors	325	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00202	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

30

Reachable functions

127

Percentage of reachable functions covered

76.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_idn2_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	177	54.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.30%
lawngreen	50+	147	45.2%
All colors	325	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
151	155	12 : View List ['fgets', 'add_punycode_if_needed', 'vector_alloc', 'isspace_ascii', 'psl_idna_close', 'vector_find', 'vector_sort', 'psl_idna_open', 'vector_get', 'suffix_init', 'strstr', 'vector_add']	151	155	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1204
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00202	/src/libidn2/lib/idna.c:233
37	37	1 : View List ['c_strncasecmp']	37	45	label	call site: 00253	/src/libidn2/lib/lookup.c:222
6	6	2 : View List ['malloc', '__errno_location']	8	20	u32_normalize	call site: 00154	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
6	6	2 : View List ['malloc', '__errno_location']	8	20	u8_normalize	call site: 00089	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00065	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['malloc', 'realloc']	8	12	libunistring_u8_casemap	call site: 00064	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00176	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00154	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00092	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	2 : View List ['malloc', '__errno_location']	2	2	u32_to_u8	call site: 00165	/src/libunistring/lib/unistr/u32-to-u8.c:105

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

52

Reachable functions

127

Percentage of reachable functions covered

59.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	127	40.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	186	59.2%
All colors	314	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00201	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

28

Reachable functions

119

Percentage of reachable functions covered

76.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	18
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_idn2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	213	65.7%
gold	[1:9]	11	3.39%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	100	30.8%
All colors	324	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
71	71	3 : View List ['psl_idna_open', 'psl_idna_toASCII', 'psl_idna_close']	105	187	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:861
24	24	2 : View List ['vector_get', 'vector_find']	28	28	is_public_suffix	call site: 00248	/src/libpsl/src/psl.c:880
6	6	2 : View List ['malloc', '__errno_location']	8	20	u8_normalize	call site: 00067	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00042	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['malloc', 'realloc']	8	12	libunistring_u8_casemap	call site: 00041	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00071	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
0	0	None	36	132	u8_normalize	call site: 00042	/src/libunistring/lib/uninorm/u-normalize-internal.h:37
0	0	None	36	132	u8_normalize	call site: 00057	/src/libunistring/lib/uninorm/u-normalize-internal.h:254
0	0	None	34	355	libunistring_u8_casemap	call site: 00010	/src/libunistring/lib/unicase/u-casemap.h:42
0	0	None	34	355	libunistring_u8_casemap	call site: 00015	/src/libunistring/lib/unicase/u-casemap.h:125
0	0	None	34	355	libunistring_u8_casemap	call site: 00028	/src/libunistring/lib/unicase/u-casemap.h:238
0	0	None	34	355	libunistring_u8_casemap	call site: 00028	/src/libunistring/lib/unicase/u-casemap.h:248

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

78

Reachable functions

123

Percentage of reachable functions covered

36.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	24
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	147	45.3%
gold	[1:9]	3	0.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	174	53.7%
All colors	324	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00181	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

29

Reachable functions

123

Percentage of reachable functions covered

76.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	24
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/puny_decode.c	3
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libidn2/lib/puny_encode.c	3
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1070	68.1%
gold	[1:9]	187	11.9%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	310	19.7%
All colors	1569	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00724	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00680	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00758	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

396

Reachable functions

798

Percentage of reachable functions covered

50.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	24
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	3
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	20
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	9
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	6
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	13
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	9
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ucnv_err.cpp	2
icu/source/common/ucnv_cb.cpp	5
icu/source/common/ucnv_cnv.cpp	2
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	7
icu/source/common/uloc_tag.cpp	31
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	35
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	1
icu/source/common/ustrcase.cpp	1
icu/source/common/utrace.cpp	1

Fuzzer: libpsl_icu_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1163	74.1%
gold	[1:9]	31	1.97%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	375	23.9%
All colors	1569	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00724	/src/icu/source/common/ucnv_bld.cpp:800
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
71	71	3 : View List ['psl_idna_open', 'psl_idna_toASCII', 'psl_idna_close']	105	187	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:861
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00680	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00758	/src/icu/source/common/ucnv_bld.cpp:981
37	50	5 : View List ['ucnv_deleteSharedConverterData(UConverterSharedData*)', 'umtx_unlock_59', 'uhash_nextElement_59', 'uhash_removeElement_59', 'umtx_lock_59']	37	50	ucnv_flushCache_59	call site: 00676	/src/icu/source/common/ucnv_bld.cpp:1043
36	38	2 : View List ['icu_59::MaybeStackArray ::getCapacity() const', 'icu_59::MaybeStackArray ::resize(int, int)']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136
35	35	2 : View List ['U_FAILURE(UErrorCode) [clone .2510]', '_uhash_rehash(UHashtable*, UErrorCode*)']	35	56	_uhash_put(UHashtable*,UElement,UElement,signedchar,UErrorCode*)	call site: 00000	/src/icu/source/common/uhash.cpp:489
35	35	1 : View List ['icu_59::Edits::addUnchanged(int)']	35	35	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:73
24	2424	2 : View List ['icu_59::Locale::operator=(icu_59::Locale const&)', 'icu_59::Locale::getDefault()']	24	2424	icu_59::Locale::init(charconst*,signedchar)	call site: 00000	/src/icu/source/common/locid.cpp:512

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

522

Reachable functions

798

Percentage of reachable functions covered

34.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	24
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	3
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	20
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	9
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	6
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	13
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	9
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ucnv_err.cpp	2
icu/source/common/ucnv_cb.cpp	5
icu/source/common/ucnv_cnv.cpp	2
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	7
icu/source/common/uloc_tag.cpp	31
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	35
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	1
icu/source/common/ustrcase.cpp	1
icu/source/common/utrace.cpp	1

Fuzzer: libpsl_icu_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	299	47.7%
gold	[1:9]	164	26.1%
yellow	[10:29]	3	0.47%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	160	25.5%
All colors	626	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
36	38	2 : View List ['icu_59::MaybeStackArray ::getCapacity() const', 'icu_59::MaybeStackArray ::resize(int, int)']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136
35	35	2 : View List ['U_FAILURE(UErrorCode) [clone .2510]', '_uhash_rehash(UHashtable*, UErrorCode*)']	35	56	_uhash_put(UHashtable*,UElement,UElement,signedchar,UErrorCode*)	call site: 00000	/src/icu/source/common/uhash.cpp:489
30	30	1 : View List ['utf8_nextCharSafeBodyPointer(unsigned char const**, unsigned char const*, int)']	30	40	u_strFromUTF8WithSub_59	call site: 00510	/src/icu/source/common/ustrtrns.cpp:452
24	24	1 : View List ['icu_59::UTS46::checkLabelBiDi(char16_t const*, int, icu_59::IDNAInfo&) const']	104	708	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:829
18	18	1 : View List ['icu_59::UnicodeString::pinIndex(int&) const']	34	185	icu_59::UnicodeString::doReplace(int,int,char16_tconst*,int,int)	call site: 00000	/src/icu/source/common/unistr.cpp:1428
14	14	1 : View List ['icu_59::UnicodeString::setToBogus()']	14	16	icu_59::UnicodeString::UnicodeString(signedchar,icu_59::ConstChar16Ptr,int)	call site: 00000	/src/icu/source/common/unistr.cpp:228

Runtime coverage analysis

Covered functions

276

Functions that are reachable but not covered

128

Reachable functions

402

Percentage of reachable functions covered

68.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	18
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	17
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	4
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	288	46.0%
gold	[1:9]	164	26.1%
yellow	[10:29]	3	0.47%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	171	27.3%
All colors	626	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

118

Reachable functions

402

Percentage of reachable functions covered

70.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	18
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	17
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	4
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	294	46.0%
gold	[1:9]	164	25.7%
yellow	[10:29]	3	0.47%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	177	27.7%
All colors	638	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
824	834	4 : View List ['umtx_unlock_59', 'ucnv_load_59', 'U_FAILURE(UErrorCode) [clone .379]', 'umtx_lock_59']	824	834	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	175	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
60	156	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	60	156	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

487

Functions that are reachable but not covered

119

Reachable functions

409

Percentage of reachable functions covered

70.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	17
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	4
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8

Fuzzer: libpsl_icu_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	338	52.9%
gold	[1:9]	164	25.7%
yellow	[10:29]	2	0.31%
greenyellow	[30:49]	1	0.15%
lawngreen	50+	133	20.8%
All colors	638	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
820	820	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	822	1903	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
737	881	12 : View List ['udata_findCachedData(char const*, UErrorCode&)', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'uprv_mapFile_59', 'icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'U_FAILURE(UErrorCode) [clone .2245]', 'U_SUCCESS(UErrorCode) [clone .2248]', 'UDataMemory_isLoaded_59', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'u_getDataDirectory_59', 'findBasename(char const*)', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'udata_checkCommonData_59']	737	881	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
571	676	19 : View List ['icu_59::ReorderingBuffer::length() const', 'icu_59::ReorderingBuffer::equals(char16_t const*, char16_t const*) const', 'icu_59::Normalizer2Impl::findNextCompBoundary(char16_t const*, char16_t const*) const', 'icu_59::Normalizer2Impl::decomposeShort(char16_t const*, char16_t const*, icu_59::ReorderingBuffer&, UErrorCode&) const', 'icu_59::ReorderingBuffer::getLastCC() const', 'icu_59::ReorderingBuffer::setLastChar(char16_t)', 'icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'icu_59::ReorderingBuffer::append(int, unsigned char, UErrorCode&)', 'icu_59::Hangul::isHangulWithoutJamoT(char16_t)', 'icu_59::Normalizer2Impl::getTrailCCFromCompYesAndZeroCC(char16_t const*, char16_t const*) const', 'icu_59::ReorderingBuffer::appendBMP(char16_t, unsigned char, UErrorCode&)', 'icu_59::Normalizer2Impl::hasCompBoundaryBefore(int, unsigned short) const', 'icu_59::Normalizer2Impl::recompose(icu_59::ReorderingBuffer&, int, signed char) const', 'icu_59::ReorderingBuffer::remove()', 'icu_59::Normalizer2Impl::getNorm16(int) const', 'icu_59::Normalizer2Impl::isMaybeOrNonZeroCC(unsigned short) const', 'icu_59::ReorderingBuffer::removeSuffix(int)', 'icu_59::Normalizer2Impl::isJamoVT(unsigned short)', 'icu_59::Normalizer2Impl::isCompYesAndZeroCC(unsigned short) const']	571	676	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1157
162	162	3 : View List ['icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'u_strchr_59', 'U_FAILURE(UErrorCode) [clone .5550]']	733	838	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
152	152	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	154	1235	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
151	155	12 : View List ['fgets', 'add_punycode_if_needed', 'vector_alloc', 'isspace_ascii', 'psl_idna_close', 'vector_find', 'vector_sort', 'psl_idna_open', 'vector_get', 'suffix_init', 'strstr', 'vector_add']	151	155	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1204
124	129	2 : View List ['icu_59::UnicodeString::length() const', 'u_strFromPunycode_59']	600	1504	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:704
98	98	1 : View List ['icu_59::UTS46::markBadACELabel(icu_59::UnicodeString&, int, int, signed char, icu_59::IDNAInfo&, UErrorCode&) const']	98	235	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:826
78	81	2 : View List ['icu_59::UnicodeString::getBuffer() const', 'icu_59::UnicodeString::replace(int, int, char16_t)']	280	887	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:817
66	112	2 : View List ['icu_59::UnicodeString::~UnicodeString()', 'icu_59::UnicodeString::tempSubString(int, int) const']	260	1146	icu_59::UTS46::processUnicode(icu_59::UnicodeStringconst&,int,int,signedchar,signedchar,icu_59::UnicodeString&,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:532
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	656	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
36	38	2 : View List ['icu_59::MaybeStackArray ::getCapacity() const', 'icu_59::MaybeStackArray ::resize(int, int)']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

145

Reachable functions

409

Percentage of reachable functions covered

64.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	24
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	10
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	3
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	1
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	17
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/ustring.cpp	4
icu/source/common/./unicode/char16ptr.h	6
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	8