Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzer details

Fuzzer: cxa_demangle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 475 29.2%
gold [1:9] 150 9.24%
yellow [10:29] 32 1.97%
greenyellow [30:49] 15 0.92%
lawngreen 50+ 950 58.5%
All colors 1622 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1774 3574 4 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseUnresolvedType()', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::look(unsigned int) const', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::NameWithTemplateArgs, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseTemplateArgs(bool)']

1782 5379 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseUnresolvedName(bool) call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:3824
1772 1772 1 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseDestructorName()']

1772 1774 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseBaseUnresolvedName() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:3749
30 32 7 :

['(anonymous namespace)::itanium_demangle::OutputBuffer::getBuffer()', '__abort_message', '(anonymous namespace)::itanium_demangle::OutputBuffer::getCurrentPosition() const', '(anonymous namespace)::itanium_demangle::OutputBuffer::OutputBuffer(char*, unsigned long*)', '(anonymous namespace)::itanium_demangle::Node::print((anonymous namespace)::itanium_demangle::OutputBuffer&) const', '(anonymous namespace)::itanium_demangle::PODSmallVector<(anonymous namespace)::itanium_demangle::ForwardTemplateReference*, 4ul>::empty() const', '(anonymous namespace)::itanium_demangle::OutputBuffer::operator+=(char)']

156 158 __cxa_demangle call site: 00021 /src/llvm-project/libcxxabi/src/cxa_demangle.cpp:392
2 2 1 :

['abort']

2 2 (anonymousnamespace)::itanium_demangle::PODSmallVector<(anonymousnamespace)::itanium_demangle::ForwardTemplateReference*,4ul>::reserve(unsignedlong) call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:60
2 2 1 :

['abort']

2 2 (anonymousnamespace)::itanium_demangle::PODSmallVector<(anonymousnamespace)::itanium_demangle::Node*,8ul>::reserve(unsignedlong) call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:60
2 2 1 :

['abort']

2 2 (anonymousnamespace)::itanium_demangle::PODSmallVector<(anonymousnamespace)::itanium_demangle::Node*,32ul>::reserve(unsignedlong) call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:60
0 5555 11 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseTemplateArg()', '(anonymous namespace)::itanium_demangle::PODSmallVector<(anonymous namespace)::itanium_demangle::Node*, 32ul>::size() const', '(anonymous namespace)::itanium_demangle::PODSmallVector<(anonymous namespace)::itanium_demangle::Node*, 32ul>::push_back((anonymous namespace)::itanium_demangle::Node* const&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseExpr()', 'std::__1::basic_string_view >::basic_string_view[abi:ne180100](char const*)', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::CallExpr, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::NodeArray, bool, (anonymous namespace)::itanium_demangle::Node::Prec>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::NodeArray&&, bool&&, (anonymous namespace)::itanium_demangle::Node::Prec&&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::consumeIf(char)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseType()', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::popTrailingNodeArray(unsigned long)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseSourceName((anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::NameState*)', 'bool std::__1::operator==[abi:ne180100] , 1>(std::__1::basic_string_view >, std::__1::__type_identity > >::type)']

0 5563 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseExpr() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:5403
0 1858 2 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseEncoding(bool)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::consumeIf(char)']

0 1860 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseTemplateArg() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:6053
0 1855 2 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseExpr()', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::NoexceptSpec, (anonymous namespace)::itanium_demangle::Node*&>((anonymous namespace)::itanium_demangle::Node*&)']

0 5578 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseFunctionType() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:3933
0 1802 4 :

['(anonymous namespace)::itanium_demangle::ScopedOverride ::ScopedOverride(bool&, bool)', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::ConstrainedTypeTemplateParamDecl, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseName((anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::NameState*)', '(anonymous namespace)::itanium_demangle::ScopedOverride ::~ScopedOverride()']

0 1838 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseTemplateParamDecl((anonymousnamespace)::itanium_demangle::PODSmallVector<(anonymousnamespace)::itanium_demangle::Node*,8ul>*) call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:5964
0 1800 3 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::getDerived()', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::NameWithTemplateArgs, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseTemplateArgs(bool)']

0 1800 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseSimpleId() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:3692
0 1800 3 :

['(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::getDerived()', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::NameWithTemplateArgs, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::Node*&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseTemplateArgs(bool)']

0 1800 (anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseBaseUnresolvedName() call site: 00000 /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h:3757

Runtime coverage analysis

Covered functions
388
Functions that are reachable but not covered
170
Reachable functions
1051
Percentage of reachable functions covered
83.82%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/llvm-project/libcxxabi/fuzz/cxa_demangle_fuzzer.cpp 1
cxa_demangle.cpp 139
demangle/ItaniumDemangle.h 368
demangle/StringViewExtras.h 2
abort_message.cpp 1
demangle/Utility.h 12

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
void(anonymousnamespace)::DumpVisitor::operator()<(anonymousnamespace)::itanium_demangle::NewExpr>((anonymousnamespace)::itanium_demangle::NewExprconst*) /src/llvm-project/libcxxabi/src/cxa_demangle.cpp 2 ['N/A', 'N/A'] 11 0 38 3 2 60 0 204 190
(anonymousnamespace)::itanium_demangle::ReferenceType::printLeft((anonymousnamespace)::itanium_demangle::OutputBuffer&)const /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h 2 ['N/A', 'N/A'] 4 0 176 31 27 37 0 93 73
void(anonymousnamespace)::DumpVisitor::operator()<(anonymousnamespace)::itanium_demangle::FunctionEncoding>((anonymousnamespace)::itanium_demangle::FunctionEncodingconst*) /src/llvm-project/libcxxabi/src/cxa_demangle.cpp 2 ['N/A', 'N/A'] 11 0 38 3 2 54 0 182 42
(anonymousnamespace)::itanium_demangle::SizeofParamPackExpr::printLeft((anonymousnamespace)::itanium_demangle::OutputBuffer&)const /src/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h 2 ['N/A', 'N/A'] 4 0 61 7 6 30 0 62 40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
48.0%
580 / 1196
Cyclomatic complexity statically reachable by fuzzers
57.9%
2245 / 3899

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzz engine guidance

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/llvm-project/libcxxabi/fuzz/cxa_demangle_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag


Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['(anonymous namespace)::itanium_demangle::SpecialName::SpecialName(std::__1::basic_string_view >, (anonymous namespace)::itanium_demangle::Node const*)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseExpr()', '(anonymous namespace)::BumpPointerAllocator::~BumpPointerAllocator()', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseExprPrimary()', '(anonymous namespace)::itanium_demangle::DeleteExpr::DeleteExpr((anonymous namespace)::itanium_demangle::Node*, bool, bool, (anonymous namespace)::itanium_demangle::Node::Prec)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseType()', '(anonymous namespace)::itanium_demangle::ConversionExpr* (anonymous namespace)::DefaultAllocator::makeNode<(anonymous namespace)::itanium_demangle::ConversionExpr, (anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::NodeArray&, (anonymous namespace)::itanium_demangle::Node::Prec>((anonymous namespace)::itanium_demangle::Node*&, (anonymous namespace)::itanium_demangle::NodeArray&, (anonymous namespace)::itanium_demangle::Node::Prec&&)', '(anonymous namespace)::itanium_demangle::Node* (anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::make<(anonymous namespace)::itanium_demangle::EnclosingExpr, char const (&) [9], (anonymous namespace)::itanium_demangle::Node*&>(char const (&) [9], (anonymous namespace)::itanium_demangle::Node*&)', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseBaseUnresolvedName()', '(anonymous namespace)::itanium_demangle::AbstractManglingParser<(anonymous namespace)::itanium_demangle::ManglingParser<(anonymous namespace)::DefaultAllocator>, (anonymous namespace)::DefaultAllocator>::parseSpecialName()']

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parse(bool) 32 14 43.75% ['cxa_demangle_fuzzer']
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseSpecialName() 121 43 35.53% ['cxa_demangle_fuzzer']
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseExpr() 258 101 39.14% ['cxa_demangle_fuzzer']
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseExprPrimary() 104 41 39.42% ['cxa_demangle_fuzzer']
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseUnresolvedName(bool) 69 26 37.68% ['cxa_demangle_fuzzer']
(anonymousnamespace)::itanium_demangle::AbstractManglingParser<(anonymousnamespace)::itanium_demangle::ManglingParser<(anonymousnamespace)::DefaultAllocator>,(anonymousnamespace)::DefaultAllocator>::parseVectorType() 32 15 46.87% ['cxa_demangle_fuzzer']