High level conclusions

Fuzzers reach 25.74% of cyclomatic complexity.

Fuzzers reach 25.71% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

584 / 2271

Cyclomatic complexity statically reachable by fuzzers

5042 / 19585

Runtime code coverage of functions

583 / 2271

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libpsl_idn_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	63	34.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.55%
lawngreen	50+	117	64.6%
All colors	181	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
463	467	12 : View List ['vector_get', 'psl_idna_open', 'vector_find', 'fgets', 'vector_sort', 'psl_idna_close', 'vector_add', 'vector_alloc', 'add_punycode_if_needed', 'suffix_init', 'strstr', 'isspace_ascii']	463	467	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1211
0	0	None	479	495	psl_load_fp	call site: 00004	/src/libpsl/src/psl.c:1199
0	0	None	477	493	psl_load_fp	call site: 00005	/src/libpsl/src/psl.c:1202
0	0	None	475	491	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1206
0	0	None	34	501	is_public_suffix	call site: 00133	/src/libpsl/src/psl.c:856
0	0	None	32	116	is_public_suffix	call site: 00135	/src/libpsl/src/psl.c:871
0	0	None	12	356	idna_to_ascii_4z	call site: 00115	/src/libidn/lib/idna.c:537
0	0	None	8	130	_g_utf8_normalize_wc	call site: 00063	/src/libidn/lib/nfkc.c:763
0	0	None	8	130	_g_utf8_normalize_wc	call site: 00065	/src/libidn/lib/nfkc.c:773
0	0	None	6	307	stringprep	call site: 00057	/src/libidn/lib/stringprep.c:433
0	0	None	6	18	psl_load_fp	call site: 00009	/src/libpsl/src/psl.c:1219
0	0	None	6	18	psl_load_fp	call site: 00011	/src/libpsl/src/psl.c:1227

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

35

Reachable functions

88

Percentage of reachable functions covered

60.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_idn_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	3.55%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.59%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	162	95.8%
All colors	169	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	26	495	psl_load_fp	call site: 00002	/src/libpsl/src/psl.c:1199
0	0	None	24	493	psl_load_fp	call site: 00003	/src/libpsl/src/psl.c:1202
0	0	None	12	356	idna_to_ascii_4z	call site: 00113	/src/libidn/lib/idna.c:537
0	0	None	10	501	is_public_suffix	call site: 00131	/src/libpsl/src/psl.c:856
0	0	None	8	116	is_public_suffix	call site: 00133	/src/libpsl/src/psl.c:871
0	0	None	6	307	stringprep	call site: 00055	/src/libidn/lib/stringprep.c:433
0	0	None	6	18	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1219
0	0	None	6	18	psl_load_fp	call site: 00009	/src/libpsl/src/psl.c:1227
0	0	None	4	647	idna_to_ascii_4i	call site: 00048	/src/libidn/lib/idna.c:141
0	0	None	4	502	psl_load_file	call site: 00165	/src/libpsl/src/psl.c:1167
0	0	None	4	12	stringprep	call site: 00090	/src/libidn/lib/stringprep.c:452
0	0	None	2	58	idna_to_ascii_4i	call site: 00098	/src/libidn/lib/idna.c:158

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

20

Reachable functions

80

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	65.9%
gold	[1:9]	9	9.89%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	22	24.1%
All colors	91	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
489	489	3 : View List ['strchr', 'strlen', 'is_public_suffix']	489	489	psl_registrable_domain	call site: 00056	/src/libpsl/src/psl.c:1119
0	0	None	489	489	psl_unregistrable_domain	call site: 00052	/src/libpsl/src/psl.c:1065
0	0	None	485	485	psl_is_public_suffix	call site: 00003	/src/libpsl/src/psl.c:999
0	0	None	485	485	psl_is_public_suffix2	call site: 00047	/src/libpsl/src/psl.c:1034
0	0	None	428	438	psl_str_to_utf8lower	call site: 00073	/src/libpsl/src/psl.c:1800
0	0	None	53	547	psl_is_cookie_domain_acceptable	call site: 00060	/src/libpsl/src/psl.c:1711
0	0	None	4	4	psl_str_to_utf8lower	call site: 00075	/src/libpsl/src/psl.c:1808
0	0	None	2	2	psl_strdup	call site: 00017	/src/libpsl/src/psl.c:322
0	0	None	0	0	psl_builtin_outdated	call site: 00087	/src/libpsl/src/psl.c:1517
0	0	None	0	0	psl_check_version_number	call site: 00083	/src/libpsl/src/psl.c:1577

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

34

Reachable functions

52

Percentage of reachable functions covered

34.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	34
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl_idn2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	220	66.2%
gold	[1:9]	11	3.31%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	101	30.4%
All colors	332	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
385	385	3 : View List ['psl_idna_close', 'psl_idna_toASCII', 'psl_idna_open']	419	501	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:868
24	24	2 : View List ['vector_get', 'vector_find']	28	28	is_public_suffix	call site: 00249	/src/libpsl/src/psl.c:887
6	6	2 : View List ['__errno_location', 'malloc']	8	20	u8_normalize	call site: 00067	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00042	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['realloc', 'malloc']	8	12	libunistring_u8_casemap	call site: 00041	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00071	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
0	3	1 : View List ['hexval']	0	20	is_ip6	call site: 00294	/src/libpsl/src/psl.c:1659
0	0	None	36	125	u8_normalize	call site: 00042	/src/libunistring/lib/uninorm/u-normalize-internal.h:37
0	0	None	36	125	u8_normalize	call site: 00057	/src/libunistring/lib/uninorm/u-normalize-internal.h:254
0	0	None	34	355	libunistring_u8_casemap	call site: 00010	/src/libunistring/lib/unicase/u-casemap.h:42
0	0	None	34	355	libunistring_u8_casemap	call site: 00015	/src/libunistring/lib/unicase/u-casemap.h:125
0	0	None	34	355	libunistring_u8_casemap	call site: 00028	/src/libunistring/lib/unicase/u-casemap.h:238

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

77

Reachable functions

126

Percentage of reachable functions covered

38.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	29
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl_idn_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	56.1%
gold	[1:9]	11	4.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	39.4%
All colors	251	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
385	385	3 : View List ['psl_idna_close', 'psl_idna_toASCII', 'psl_idna_open']	419	501	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:868
24	24	2 : View List ['vector_get', 'vector_find']	28	28	is_public_suffix	call site: 00094	/src/libpsl/src/psl.c:887
6	6	2 : View List ['__errno_location', 'malloc']	8	20	u8_normalize	call site: 00218	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00193	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['realloc', 'malloc']	8	12	libunistring_u8_casemap	call site: 00192	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00220	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
0	3	1 : View List ['hexval']	0	20	is_ip6	call site: 00139	/src/libpsl/src/psl.c:1659
0	0	None	36	125	u8_normalize	call site: 00193	/src/libunistring/lib/uninorm/u-normalize-internal.h:37
0	0	None	36	125	u8_normalize	call site: 00208	/src/libunistring/lib/uninorm/u-normalize-internal.h:254
0	0	None	34	355	libunistring_u8_casemap	call site: 00161	/src/libunistring/lib/unicase/u-casemap.h:42
0	0	None	34	355	libunistring_u8_casemap	call site: 00166	/src/libunistring/lib/unicase/u-casemap.h:125
0	0	None	34	355	libunistring_u8_casemap	call site: 00179	/src/libunistring/lib/unicase/u-casemap.h:238

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

58

Reachable functions

107

Percentage of reachable functions covered

45.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libunistring/lib/unistr/u8-strlen.c	1

Fuzzer: libpsl_idn2_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	185	55.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.29%
lawngreen	50+	150	44.6%
All colors	336	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
463	467	12 : View List ['vector_get', 'psl_idna_open', 'vector_find', 'fgets', 'vector_sort', 'psl_idna_close', 'vector_add', 'vector_alloc', 'add_punycode_if_needed', 'suffix_init', 'strstr', 'isspace_ascii']	463	467	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1211
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00210	/src/libidn2/lib/idna.c:233
37	37	1 : View List ['c_strncasecmp']	37	45	label	call site: 00261	/src/libidn2/lib/lookup.c:219
6	6	2 : View List ['__errno_location', 'malloc']	8	20	u32_normalize	call site: 00162	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
6	6	2 : View List ['__errno_location', 'malloc']	8	20	u8_normalize	call site: 00095	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00070	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['realloc', 'malloc']	8	12	libunistring_u8_casemap	call site: 00069	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00184	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00162	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00099	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	2 : View List ['__errno_location', 'malloc']	2	2	u32_to_u8	call site: 00173	/src/libunistring/lib/unistr/u32-to-u8.c:105

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

52

Reachable functions

127

Percentage of reachable functions covered

59.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	26
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_idn2_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	27.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	234	72.2%
All colors	324	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6	924	9 : View List ['get_map_data', 'idn2_punycode_decode', 'map_is', 'u32_normalize', 'u32_to_u8', '_idn2_label_test', 'malloc', '__errno_location', 'get_idna_map']	6	964	_tr46	call site: 00134	/src/libidn2/lib/lookup.c:288
6	6	2 : View List ['__errno_location', 'malloc']	8	20	u8_normalize	call site: 00093	/src/libunistring/lib/uninorm/u-normalize-internal.h:339
6	6	1 : View List ['__errno_location']	6	14	u32_normalize	call site: 00160	/src/libunistring/lib/uninorm/u-normalize-internal.h:345
4	4	1 : View List ['__errno_location']	4	8	libunistring_u8_casemap	call site: 00068	/src/libunistring/lib/unicase/u-casemap.h:383
2	2	2 : View List ['realloc', 'malloc']	8	12	libunistring_u8_casemap	call site: 00067	/src/libunistring/lib/unicase/u-casemap.h:377
2	2	1 : View List ['__errno_location']	2	2	_idn2_label_test	call site: 00182	/src/libidn2/lib/idna.c:144
2	2	1 : View List ['abort']	2	2	uc_canonical_decomposition	call site: 00000	/src/libunistring/lib/uninorm/canonical-decomposition.c:88
2	2	1 : View List ['abort']	2	2	u32_normalize	call site: 00160	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['abort']	2	2	u8_normalize	call site: 00097	/src/libunistring/lib/uninorm/u-normalize-internal.h:362
2	2	1 : View List ['__errno_location']	2	2	u32_to_u8	call site: 00171	/src/libunistring/lib/unistr/u32-to-u8.c:111
2	2	2 : View List ['__errno_location', 'malloc']	2	2	u8_to_u32	call site: 00121	/src/libunistring/lib/unistr/u8-to-u32.c:100
0	10	1 : View List ['_idn2_contextj_p']	43	215	_idn2_label_test	call site: 00194	/src/libidn2/lib/idna.c:195

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

28

Reachable functions

119

Percentage of reachable functions covered

76.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	20
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	29.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.93%
lawngreen	50+	74	69.1%
All colors	107	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

17

Reachable functions

61

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	33
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	48	26.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.55%
lawngreen	50+	132	72.9%
All colors	181	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

22

Reachable functions

88

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	36.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.30%
lawngreen	50+	204	62.9%
All colors	324	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00208	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

28

Reachable functions

119

Percentage of reachable functions covered

76.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	20
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	1.05%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	1.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	93	97.8%
All colors	95	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	26	495	psl_load_fp	call site: 00002	/src/libpsl/src/psl.c:1199
0	0	None	24	493	psl_load_fp	call site: 00003	/src/libpsl/src/psl.c:1202
0	0	None	10	501	is_public_suffix	call site: 00057	/src/libpsl/src/psl.c:856
0	0	None	8	116	is_public_suffix	call site: 00059	/src/libpsl/src/psl.c:871
0	0	None	6	18	psl_load_fp	call site: 00007	/src/libpsl/src/psl.c:1219
0	0	None	6	18	psl_load_fp	call site: 00009	/src/libpsl/src/psl.c:1227
0	0	None	4	502	psl_load_file	call site: 00091	/src/libpsl/src/psl.c:1167
0	0	None	2	2	vector_add	call site: 00027	/src/libpsl/src/psl.c:243
0	0	None	2	2	psl_strdup	call site: 00043	/src/libpsl/src/psl.c:322
0	0	None	0	0	is_public_suffix	call site: 00057	/src/libpsl/src/psl.c:848
0	0	None	0	0	is_public_suffix	call site: 00062	/src/libpsl/src/psl.c:893
0	0	None	0	0	is_public_suffix	call site: 00080	/src/libpsl/src/psl.c:913

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

15

Reachable functions

53

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl_icu_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1243	74.3%
gold	[1:9]	31	1.85%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	397	23.7%
All colors	1671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00768	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
385	385	3 : View List ['psl_idna_close', 'psl_idna_toASCII', 'psl_idna_open']	419	501	is_public_suffix	call site: 00004	/src/libpsl/src/psl.c:868
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00722	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00804	/src/icu/source/common/ucnv_bld.cpp:981
37	50	5 : View List ['umtx_unlock_59', 'umtx_lock_59', 'uhash_removeElement_59', 'ucnv_deleteSharedConverterData(UConverterSharedData*)', 'uhash_nextElement_59']	37	50	ucnv_flushCache_59	call site: 00718	/src/icu/source/common/ucnv_bld.cpp:1043
36	38	2 : View List ['icu_59::MaybeStackArray ::resize(int, int)', 'icu_59::MaybeStackArray ::getCapacity() const']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136
35	35	2 : View List ['U_FAILURE(UErrorCode) [clone .2582]', '_uhash_rehash(UHashtable*, UErrorCode*)']	35	56	_uhash_put(UHashtable*,UElement,UElement,signedchar,UErrorCode*)	call site: 00000	/src/icu/source/common/uhash.cpp:489
35	35	1 : View List ['icu_59::Edits::addUnchanged(int)']	35	35	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:73
24	2432	2 : View List ['icu_59::Locale::operator=(icu_59::Locale const&)', 'icu_59::Locale::getDefault()']	24	2432	icu_59::Locale::init(charconst*,signedchar)	call site: 00000	/src/icu/source/common/locid.cpp:512

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

514

Reachable functions

798

Percentage of reachable functions covered

35.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	28
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	4
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	24
icu/source/common/ustring.cpp	7
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	11
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	10
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	10
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	8
icu/source/common/uloc_tag.cpp	33
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	36
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	8
icu/source/common/ustrcase.cpp	6
icu/source/common/edits.cpp	5
icu/source/common/./unicode/edits.h	2
icu/source/common/utrace.cpp	1

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	329	49.0%
gold	[1:9]	56	8.34%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	285	42.4%
All colors	671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

114

Reachable functions

409

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl_icu_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	311	46.3%
gold	[1:9]	179	26.6%
yellow	[10:29]	3	0.44%
greenyellow	[30:49]	4	0.59%
lawngreen	50+	174	25.9%
All colors	671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
36	38	2 : View List ['icu_59::MaybeStackArray ::resize(int, int)', 'icu_59::MaybeStackArray ::getCapacity() const']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136
35	35	2 : View List ['U_FAILURE(UErrorCode) [clone .2582]', '_uhash_rehash(UHashtable*, UErrorCode*)']	35	56	_uhash_put(UHashtable*,UElement,UElement,signedchar,UErrorCode*)	call site: 00000	/src/icu/source/common/uhash.cpp:489
30	30	1 : View List ['utf8_nextCharSafeBodyPointer(unsigned char const**, unsigned char const*, int)']	30	40	u_strFromUTF8WithSub_59	call site: 00547	/src/icu/source/common/ustrtrns.cpp:452
24	24	1 : View List ['icu_59::UTS46::checkLabelBiDi(char16_t const*, int, icu_59::IDNAInfo&) const']	104	804	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:829
22	22	1 : View List ['icu_59::UnicodeString::pinIndex(int&) const']	38	253	icu_59::UnicodeString::doReplace(int,int,char16_tconst*,int,int)	call site: 00000	/src/icu/source/common/unistr.cpp:1428
14	14	1 : View List ['icu_59::UnicodeString::setToBogus()']	14	16	icu_59::UnicodeString::UnicodeString(signedchar,icu_59::ConstChar16Ptr,int)	call site: 00000	/src/icu/source/common/unistr.cpp:228

Runtime coverage analysis

Covered functions

277

Functions that are reachable but not covered

125

Reachable functions

409

Percentage of reachable functions covered

69.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	39.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.93%
lawngreen	50+	64	59.8%
All colors	107	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
463	467	12 : View List ['vector_get', 'psl_idna_open', 'vector_find', 'fgets', 'vector_sort', 'psl_idna_close', 'vector_add', 'vector_alloc', 'add_punycode_if_needed', 'suffix_init', 'strstr', 'isspace_ascii']	463	467	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1211
0	0	None	479	495	psl_load_fp	call site: 00004	/src/libpsl/src/psl.c:1199
0	0	None	477	493	psl_load_fp	call site: 00005	/src/libpsl/src/psl.c:1202
0	0	None	475	491	psl_load_fp	call site: 00006	/src/libpsl/src/psl.c:1206
0	0	None	34	501	is_public_suffix	call site: 00059	/src/libpsl/src/psl.c:856
0	0	None	32	116	is_public_suffix	call site: 00061	/src/libpsl/src/psl.c:871
0	0	None	6	18	psl_load_fp	call site: 00009	/src/libpsl/src/psl.c:1219
0	0	None	6	18	psl_load_fp	call site: 00011	/src/libpsl/src/psl.c:1227
0	0	None	2	2	psl_strdup	call site: 00045	/src/libpsl/src/psl.c:322
0	0	None	0	10	psl_load_fp	call site: 00009	/src/libpsl/src/psl.c:1216
0	0	None	0	2	psl_load_fp	call site: 00012	/src/libpsl/src/psl.c:1234
0	0	None	0	0	psl_suffix_count	call site: 00093	/src/libpsl/src/psl.c:1397

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

29

Reachable functions

61

Percentage of reachable functions covered

52.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	33
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	33	34.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.05%
lawngreen	50+	61	64.2%
All colors	95	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

15

Reachable functions

53

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	26	28.5%
gold	[1:9]	3	3.29%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	62	68.1%
All colors	91	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

8

Reachable functions

52

Percentage of reachable functions covered

84.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	34
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	36.6%
gold	[1:9]	3	1.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	156	62.1%
All colors	251	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

22

Reachable functions

107

Percentage of reachable functions covered

79.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libunistring/lib/unistr/u8-strlen.c	1

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	28.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.59%
lawngreen	50+	119	70.4%
All colors	169	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

20

Reachable functions

80

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_icu_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	357	52.2%
gold	[1:9]	179	26.2%
yellow	[10:29]	2	0.29%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	144	21.0%
All colors	683	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
463	467	12 : View List ['vector_get', 'psl_idna_open', 'vector_find', 'fgets', 'vector_sort', 'psl_idna_close', 'vector_add', 'vector_alloc', 'add_punycode_if_needed', 'suffix_init', 'strstr', 'isspace_ascii']	463	467	psl_load_fp	call site: 00008	/src/libpsl/src/psl.c:1211
422	721	19 : View List ['icu_59::ReorderingBuffer::removeSuffix(int)', 'icu_59::Normalizer2Impl::getTrailCCFromCompYesAndZeroCC(char16_t const*, char16_t const*) const', 'icu_59::Normalizer2Impl::recompose(icu_59::ReorderingBuffer&, int, signed char) const', 'icu_59::ReorderingBuffer::getLastCC() const', 'icu_59::Normalizer2Impl::decomposeShort(char16_t const*, char16_t const*, icu_59::ReorderingBuffer&, UErrorCode&) const', 'icu_59::Normalizer2Impl::isJamoVT(unsigned short)', 'icu_59::ReorderingBuffer::equals(char16_t const*, char16_t const*) const', 'icu_59::ReorderingBuffer::remove()', 'icu_59::ReorderingBuffer::append(int, unsigned char, UErrorCode&)', 'icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'icu_59::Normalizer2Impl::isCompYesAndZeroCC(unsigned short) const', 'icu_59::Normalizer2Impl::getNorm16(int) const', 'icu_59::ReorderingBuffer::setLastChar(char16_t)', 'icu_59::Normalizer2Impl::hasCompBoundaryBefore(int, unsigned short) const', 'icu_59::Normalizer2Impl::findNextCompBoundary(char16_t const*, char16_t const*) const', 'icu_59::Normalizer2Impl::isMaybeOrNonZeroCC(unsigned short) const', 'icu_59::Hangul::isHangulWithoutJamoT(char16_t)', 'icu_59::ReorderingBuffer::length() const', 'icu_59::ReorderingBuffer::appendBMP(char16_t, unsigned char, UErrorCode&)']	422	721	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1157
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	581	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
124	131	2 : View List ['icu_59::UnicodeString::length() const', 'u_strFromPunycode_59']	352	1836	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:704
124	127	2 : View List ['icu_59::UnicodeString::replace(int, int, char16_t)', 'icu_59::UnicodeString::getBuffer() const']	228	1075	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:817
93	93	1 : View List ['icu_59::UnicodeString::doAppend(char16_t const*, int, int)']	93	93	icu_59::UnicodeString::doReplace(int,int,char16_tconst*,int,int)	call site: 00000	/src/icu/source/common/unistr.cpp:1447
70	116	2 : View List ['icu_59::UnicodeString::~UnicodeString()', 'icu_59::UnicodeString::tempSubString(int, int) const']	272	1172	icu_59::UTS46::processUnicode(icu_59::UnicodeStringconst&,int,int,signedchar,signedchar,icu_59::UnicodeString&,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:532
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
36	38	2 : View List ['icu_59::MaybeStackArray ::resize(int, int)', 'icu_59::MaybeStackArray ::getCapacity() const']	36	38	icu_59::CharString::ensureCapacity(int,int,UErrorCode&)	call site: 00000	/src/icu/source/common/charstr.cpp:136

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

143

Reachable functions

416

Percentage of reachable functions covered

65.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	118	35.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.29%
lawngreen	50+	217	64.5%
All colors	336	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00210	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

30

Reachable functions

127

Percentage of reachable functions covered

76.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	26
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1129	67.5%
gold	[1:9]	79	4.72%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	463	27.7%
All colors	1671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00768	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00722	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00804	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

382

Reachable functions

798

Percentage of reachable functions covered

52.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	28
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	4
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	24
icu/source/common/ustring.cpp	7
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	11
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	10
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	10
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	8
icu/source/common/uloc_tag.cpp	33
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	36
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	8
icu/source/common/ustrcase.cpp	6
icu/source/common/edits.cpp	5
icu/source/common/./unicode/edits.h	2
icu/source/common/utrace.cpp	1

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	328	48.0%
gold	[1:9]	56	8.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	298	43.6%
All colors	683	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00000	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

115

Reachable functions

416

Percentage of reachable functions covered

72.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	36.7%
gold	[1:9]	3	0.90%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	207	62.3%
All colors	332	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
828	828	1 : View List ['icu_59::Norm2AllModes::getNFKCInstance(UErrorCode&)']	830	1929	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:221
826	836	4 : View List ['U_FAILURE(UErrorCode) [clone .398]', 'ucnv_load_59', 'umtx_unlock_59', 'umtx_lock_59']	826	836	ucnv_loadSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:800
753	897	12 : View List ['icu_59::UDataPathIterator::UDataPathIterator(char const*, char const*, char const*, char const*, signed char, UErrorCode*)', 'findBasename(char const*)', 'U_FAILURE(UErrorCode) [clone .2317]', 'udata_findCachedData(char const*, UErrorCode&)', 'icu_59::UDataPathIterator::~UDataPathIterator()', 'udata_checkCommonData_59', 'icu_59::UDataPathIterator::next(UErrorCode*)', 'uprv_mapFile_59', 'UDataMemory_isLoaded_59', 'U_SUCCESS(UErrorCode) [clone .2320]', 'udata_cacheDataItem(char const*, UDataMemory*, UErrorCode*)', 'u_getDataDirectory_59']	753	897	openCommonData(charconst*,int,UErrorCode*)	call site: 00000	/src/icu/source/common/udata.cpp:671
159	159	3 : View List ['u_strchr_59', 'icu_59::Normalizer2Impl::copyLowPrefixFromNulTerminated(char16_t const*, int, icu_59::ReorderingBuffer*, UErrorCode&) const', 'U_FAILURE(UErrorCode) [clone .5540]']	172	880	icu_59::Normalizer2Impl::compose(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1099
158	158	1 : View List ['icu_59::Norm2AllModes::getNFCInstance(UErrorCode&)']	160	1259	icu_59::Normalizer2::getInstance(charconst*,charconst*,UNormalization2Mode,UErrorCode&)	call site: 00000	/src/icu/source/common/loadednormalizer2impl.cpp:219
123	123	1 : View List ['_getKeywords(char const*, char, char*, int, char*, int, int*, signed char, char const*, char const*, UErrorCode*)']	125	135	_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	call site: 00000	/src/icu/source/common/uloc.cpp:1903
55	153	2 : View List ['icu_59::ReorderingBuffer::appendZeroCC(char16_t const*, char16_t const*, UErrorCode&)', 'u_strchr_59']	55	153	icu_59::Normalizer2Impl::composeAndAppend(char16_tconst*,char16_tconst*,signedchar,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	call site: 00000	/src/icu/source/common/normalizer2impl.cpp:1474
55	55	1 : View List ['icu_59::Edits::addReplace(int, int)']	55	55	appendResult(char16_t*,int,int,int,char16_tconst*,int,unsignedint,icu_59::Edits*)	call site: 00000	/src/icu/source/common/ustrcase.cpp:91
52	52	1 : View List ['icu_59::UTS46::checkLabelContextO(char16_t const*, int, icu_59::IDNAInfo&) const']	52	752	icu_59::UTS46::processLabel(icu_59::UnicodeString&,int,int,signedchar,icu_59::IDNAInfo&,UErrorCode&)const	call site: 00000	/src/icu/source/common/uts46.cpp:837
43	43	1 : View List ['_idn2_contexto_rule']	43	110	_idn2_label_test	call site: 00182	/src/libidn2/lib/idna.c:233
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	46	ucnv_close_59	call site: 00000	/src/icu/source/common/ucnv.cpp:385
42	42	1 : View List ['ucnv_unloadSharedDataIfReady_59']	42	42	ucnv_createConverterFromSharedData_59	call site: 00000	/src/icu/source/common/ucnv_bld.cpp:981

Runtime coverage analysis

Covered functions

492

Functions that are reachable but not covered

27

Reachable functions

126

Percentage of reachable functions covered

78.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	29
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/unistring/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9