High level conclusions

Fuzzers reach 96.67% code coverage.

Fuzzers reach 77.11% of cyclomatic complexity.

Fuzzers reach 61.11% of all functions.

Fuzzer lua_stringtonumber_test is blocked:

The runtime code coverage of lua_stringtonumber_test covers 19.83% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

808 / 1322

Cyclomatic complexity statically reachable by fuzzers

10102 / 13100

Runtime code coverage of functions

1278 / 1322

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: lua_stringtonumber_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4050	90.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	0.13%
lawngreen	50+	442	9.82%
All colors	4498	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9586	9586	6 : View List ['luaM_toobig', '__asan_memcpy', '__asan_report_load8', 'luaS_createlngstrobj', '__asan_handle_no_return', '__asan_report_load1']	9586	9586	luaS_newlstr	call site: 00931	/src/testdir/build/lua-master/source/lstring.c:250
4838	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	4840	4840	luaH_setint	call site: 04297	/src/testdir/build/lua-master/source/ltable.c:1208
4798	14379	6 : View List ['__asan_report_store4', '__asan_handle_no_return', '__asan_report_load8', 'luaG_runerror', 'luaO_ceillog2', 'luaM_malloc_']	4812	14393	setnodevector	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:603
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00946	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02582	/src/testdir/build/lua-master/source/ltable.c:721
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:726
6	16	5 : View List ['__asan_memcpy', 'luaM_free_', '__asan_handle_no_return', '__asan_report_load8', 'concretesize']	6	16	resizearray	call site: 00260	/src/testdir/build/lua-master/source/ltable.c:580
2	2	1 : View List ['__asan_report_store1']	9582	9582	luaC_changemode	call site: 04370	/src/testdir/build/lua-master/source/lgc.c:1442
0	4809	1 : View List ['close_state']	0	4809	lua_newstate	call site: 00087	/src/testdir/build/lua-master/source/lstate.c:382
0	0	None	220	220	reinserthash	call site: 02634	/src/testdir/build/lua-master/source/ltable.c:642
0	0	None	38	38	index2value	call site: 04409	/src/testdir/build/lua-master/source/lapi.c:66
0	0	None	22	9654	close_state	call site: 04366	/src/testdir/build/lua-master/source/lstate.c:257

Runtime coverage analysis

Covered functions

72

Functions that are reachable but not covered

291

Reachable functions

363

Percentage of reachable functions covered

19.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/lua_stringtonumber_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	8
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	52
/src/testdir/build/lua-master/source/lfunc.c	14
/src/testdir/build/lua-master/source/lstring.c	16
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	9

Fuzzer: lua_dump_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3320	47.2%
gold	[1:9]	32	0.45%
yellow	[10:29]	36	0.51%
greenyellow	[30:49]	27	0.38%
lawngreen	50+	3610	51.3%
All colors	7025	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4812	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	4846	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01203	/src/testdir/build/lua-master/source/lgc.c:1472
4792	4792	2 : View List ['__asan_memcpy', 'luaD_callnoyield']	4926	14502	luaG_errormsg	call site: 01592	/src/testdir/build/lua-master/source/ldebug.c:833
4790	4790	2 : View List ['__asan_report_load4', 'luaD_errerr']	4792	4792	luaE_checkcstack	call site: 01370	/src/testdir/build/lua-master/source/lstate.c:132
184	184	1 : View List ['reinsertOldSlice']	194	10075	luaH_resize	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:726
28	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	30	4840	luaH_setint	call site: 04297	/src/testdir/build/lua-master/source/ltable.c:1208
10	18	4 : View List ['__asan_report_load8', '__asan_report_load4', '__asan_report_store8', 'luaM_free_']	10	18	luaE_shrinkCI	call site: 01358	/src/testdir/build/lua-master/source/lstate.c:107
8	8	3 : View List ['__asan_report_load1', '__asan_handle_no_return', '__asan_report_load8']	8	8	equalkey	call site: 02284	/src/testdir/build/lua-master/source/ltable.c:258
4	4	1 : View List ['__asan_memcpy']	50	50	luaH_finishset	call site: 02509	/src/testdir/build/lua-master/source/ltable.c:1157
4	4	2 : View List ['__asan_report_store8', '__asan_report_store1']	4	4792	luaH_finishset	call site: 02518	/src/testdir/build/lua-master/source/ltable.c:1164
4	4	1 : View List ['__asan_report_load8']	4	4	checkbuffer	call site: 04510	/src/testdir/build/lua-master/source/lzio.c:52
2	9578	3 : View List ['__asan_handle_no_return', 'luaO_pushfstring', 'luaD_throw']	2	9578	checkmode	call site: 04495	/src/testdir/build/lua-master/source/ldo.c:1096

Runtime coverage analysis

Covered functions

470

Functions that are reachable but not covered

203

Reachable functions

667

Percentage of reachable functions covered

69.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/lua_dump_test.c	2
/src/testdir/build/lua-master/source/lauxlib.c	11
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	16
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	9
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105
/src/testdir/build/lua-master/source/ldump.c	17

Fuzzer: luaL_gsub_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3650	73.1%
gold	[1:9]	2	0.04%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1339	26.8%
All colors	4991	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04792	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01204	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01293	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 04931	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02589	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00947	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04780	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00926	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02582	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00920	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:726
50	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	52	4840	luaH_setint	call site: 04297	/src/testdir/build/lua-master/source/ltable.c:1208

Runtime coverage analysis

Covered functions

190

Functions that are reachable but not covered

240

Reachable functions

426

Percentage of reachable functions covered

43.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_gsub_test.cc	1
/src/testdir/build/lua-master/source/lauxlib.c	23
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	35

Fuzzer: luaL_buffaddr_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3657	73.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	11	0.22%
lawngreen	50+	1304	26.2%
All colors	4972	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04779	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01205	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01294	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 04914	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02591	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00948	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04767	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00927	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02584	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00921	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02587	/src/testdir/build/lua-master/source/ltable.c:726
50	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	52	4840	luaH_setint	call site: 04299	/src/testdir/build/lua-master/source/ltable.c:1208

Runtime coverage analysis

Covered functions

186

Functions that are reachable but not covered

240

Reachable functions

422

Percentage of reachable functions covered

43.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_buffaddr_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	21
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	34

Fuzzer: torture_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2931	60.6%
gold	[1:9]	230	4.75%
yellow	[10:29]	234	4.83%
greenyellow	[30:49]	173	3.57%
lawngreen	50+	1267	26.2%
All colors	4835	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
24797	29739	8 : View List ['lua_settop', 'newbox', 'lua_toclose', '__asan_memcpy', '__asan_report_store8', 'newbuffsize', 'lua_rotate', 'resizebox']	24807	29749	prepbuffsize	call site: 00000	/src/testdir/build/lua-master/source/lauxlib.c:566
12182	12182	2 : View List ['globalstatfunc', 'luaX_lookahead']	12210	19261	statement	call site: 00000	/src/testdir/build/lua-master/source/lparser.c:2051
9692	14480	9 : View List ['__asan_report_load4', 'unroll', '__asan_handle_no_return', '__asan_report_load8', '__asan_report_store1', 'luaD_poscall', '__asan_report_store8', '__asan_report_load1', 'luaV_execute']	9692	14480	resume	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:901
9578	9578	3 : View List ['__asan_handle_no_return', 'luaO_pushfstring', 'luaD_throw']	9578	9578	checkmode	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:1096
5398	5398	1 : View List ['luaK_prefix']	5418	40669	subexpr	call site: 00000	/src/testdir/build/lua-master/source/lparser.c:1342
5307	5307	1 : View List ['codearith']	5307	5307	codecommutative	call site: 00000	/src/testdir/build/lua-master/source/lcode.c:1557
5222	5222	1 : View List ['adjust_assign']	10494	10494	restassign	call site: 00000	/src/testdir/build/lua-master/source/lparser.c:1479
5090	5090	2 : View List ['luaU_undump', 'strchr']	5102	14693	f_parser	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:1109
4987	5014	2 : View List ['luaL_error', 'lua_isstring']	4987	9846	luaL_tolstring	call site: 00000	/src/testdir/build/lua-master/source/lauxlib.c:924
4915	23742	5 : View List ['__asan_report_load4', 'restassign', 'suffixedexp', 'luaE_incCstack', 'check_conflict']	10191	29018	restassign	call site: 00000	/src/testdir/build/lua-master/source/lparser.c:1465
4844	4844	1 : View List ['luaK_concat']	34012	34012	exp2reg	call site: 00000	/src/testdir/build/lua-master/source/lcode.c:937
4838	4838	3 : View List ['__asan_report_load4', '__asan_handle_no_return', 'undefgoto']	4842	4842	leaveblock	call site: 00000	/src/testdir/build/lua-master/source/lparser.c:743

Runtime coverage analysis

Covered functions

550

Functions that are reachable but not covered

164

Reachable functions

407

Percentage of reachable functions covered

59.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/torture_test.cc	5
/src/testdir/build/lua-master/source/lauxlib.c	13
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	16
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	43
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	23

Fuzzer: luaL_buffsub_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3657	73.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1317	26.4%
All colors	4974	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04779	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01205	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01294	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 04914	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02591	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00948	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04767	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00927	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02584	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00921	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02587	/src/testdir/build/lua-master/source/ltable.c:726
50	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	52	4840	luaH_setint	call site: 04299	/src/testdir/build/lua-master/source/ltable.c:1208

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

240

Reachable functions

421

Percentage of reachable functions covered

42.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_buffsub_test.cc	1
/src/testdir/build/lua-master/source/lauxlib.c	20
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	34

Fuzzer: fuzz_lua

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2633	34.8%
gold	[1:9]	345	4.56%
yellow	[10:29]	186	2.45%
greenyellow	[30:49]	155	2.04%
lawngreen	50+	4244	56.1%
All colors	7563	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7017	12182	2 : View List ['globalstatfunc', 'luaX_lookahead']	7045	19261	statement	call site: 05281	/src/testdir/build/lua-master/source/lparser.c:2051
5296	24585	8 : View List ['pushglobalfuncname', '__asan_report_load4', 'lua_settop', '__asan_report_load8', 'lua_tolstring', '__asan_report_load1', 'lua_pushfstring', 'lua_rotate']	5296	29393	pushfuncname	call site: 07359	/src/testdir/build/lua-master/source/lauxlib.c:99
5090	5090	2 : View List ['luaU_undump', 'strchr']	5102	14693	f_parser	call site: 04479	/src/testdir/build/lua-master/source/ldo.c:1109
5022	9816	4 : View List ['lua_typename', 'lua_type', 'lua_pushfstring', 'luaL_callmeta']	5022	15512	msghandler	call site: 06932	/src/fuzz_lua.c:101
4838	4838	3 : View List ['__asan_report_load4', '__asan_handle_no_return', 'undefgoto']	4842	4842	leaveblock	call site: 06026	/src/testdir/build/lua-master/source/lparser.c:743
4835	4835	4 : View List ['luaK_semerror', '__asan_handle_no_return', '__asan_report_load8', '__asan_report_load1']	4835	4835	buildglobal	call site: 06278	/src/testdir/build/lua-master/source/lparser.c:493
4835	4835	4 : View List ['luaK_semerror', '__asan_handle_no_return', '__asan_report_load8', '__asan_report_load1']	4835	4835	check_readonly	call site: 06310	/src/testdir/build/lua-master/source/lparser.c:313
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 06904	/src/testdir/build/lua-master/source/lapi.c:605
4829	4829	1 : View List ['luaK_semerror']	4835	4835	buildvar	call site: 06274	/src/testdir/build/lua-master/source/lparser.c:513
4812	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	4846	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01203	/src/testdir/build/lua-master/source/lgc.c:1472
4794	4794	2 : View List ['__asan_report_load8', 'rethook']	4794	4829	moveresults	call site: 01748	/src/testdir/build/lua-master/source/ldo.c:565

Runtime coverage analysis

Covered functions

569

Functions that are reachable but not covered

178

Reachable functions

740

Percentage of reachable functions covered

75.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/fuzz_lua.c	8
/src/testdir/build/lua-master/source/lauxlib.c	32
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	59
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	43
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	50
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_dostring_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	541	7.62%
gold	[1:9]	86	1.21%
yellow	[10:29]	91	1.28%
greenyellow	[30:49]	45	0.63%
lawngreen	50+	6336	89.2%
All colors	7099	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7017	7017	1 : View List ['globalfunc']	7017	7017	globalstatfunc	call site: 06616	/src/testdir/build/lua-master/source/lparser.c:1898
5642	20298	4 : View List ['loadfunc', 'lua_pushstring', 'lua_pushfstring', 'checkload']	5642	20298	searcher_Croot	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:590
5642	10696	2 : View List ['loadfunc', 'checkload']	5642	10696	searcher_C	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:577
4814	9613	2 : View List ['getaddr_', 'luaS_newextlstr']	4890	14683	loadString	call site: 04844	/src/testdir/build/lua-master/source/lundump.c:169
4814	4814	1 : View List ['getaddr_']	4842	38716	loadDebug	call site: 04917	/src/testdir/build/lua-master/source/lundump.c:298
4814	4814	1 : View List ['getaddr_']	4818	4818	loadCode	call site: 04794	/src/testdir/build/lua-master/source/lundump.c:190
4802	4802	2 : View List ['numerror', '__asan_handle_no_return']	4802	4802	checknumsize	call site: 04718	/src/testdir/build/lua-master/source/lundump.c:359
4794	4794	2 : View List ['__asan_handle_no_return', 'luaD_throwbaselevel']	4794	4794	lua_closethread	call site: 00000	/src/testdir/build/lua-master/source/lstate.c:329
203	5042	3 : View List ['lua_settop', 'lua_pushvalue', 'lua_setupvalue']	203	5042	load_aux	call site: 00000	/src/testdir/build/lua-master/source/lbaselib.c:326
32	4820	5 : View List ['__asan_handle_no_return', '__asan_report_store1', 'luaS_newlstr', '__asan_report_store8', '__asan_report_load1']	48	4836	lua_concat	call site: 00000	/src/testdir/build/lua-master/source/lapi.c:1291
24	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	58	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
12	12	2 : View List ['__asan_handle_no_return', '__asan_report_load8']	12	9674	resume	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:915

Runtime coverage analysis

Covered functions

1019

Functions that are reachable but not covered

54

Reachable functions

670

Percentage of reachable functions covered

91.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_dostring_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	13
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	57
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	25
/src/testdir/build/lua-master/source/linit.c	1
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_loadstring_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	487	6.86%
gold	[1:9]	88	1.23%
yellow	[10:29]	39	0.54%
greenyellow	[30:49]	40	0.56%
lawngreen	50+	6445	90.7%
All colors	7099	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5642	20298	4 : View List ['loadfunc', 'lua_pushstring', 'lua_pushfstring', 'checkload']	5642	20298	searcher_Croot	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:590
5642	10696	2 : View List ['loadfunc', 'checkload']	5642	10696	searcher_C	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:577
4814	9613	2 : View List ['getaddr_', 'luaS_newextlstr']	4890	14683	loadString	call site: 04844	/src/testdir/build/lua-master/source/lundump.c:169
4814	4814	1 : View List ['getaddr_']	4842	38716	loadDebug	call site: 04917	/src/testdir/build/lua-master/source/lundump.c:298
4814	4814	1 : View List ['getaddr_']	4818	4818	loadCode	call site: 04794	/src/testdir/build/lua-master/source/lundump.c:190
4802	4802	2 : View List ['numerror', '__asan_handle_no_return']	4802	4802	checknumsize	call site: 04718	/src/testdir/build/lua-master/source/lundump.c:359
4794	4794	2 : View List ['__asan_handle_no_return', 'luaD_throwbaselevel']	4794	4794	lua_closethread	call site: 00000	/src/testdir/build/lua-master/source/lstate.c:329
32	55776	13 : View List ['max_expand', '__asan_report_load8', 'matchbalance', 'end_capture', 'singlematch', 'min_expand', 'matchbracketclass', 'match', 'match_capture', '__asan_report_load1', 'luaL_error', 'start_capture', 'classend']	34	55778	match	call site: 00000	/src/testdir/build/lua-master/source/lstrlib.c:592
32	4820	5 : View List ['__asan_handle_no_return', '__asan_report_store1', 'luaS_newlstr', '__asan_report_store8', '__asan_report_load1']	48	4836	lua_concat	call site: 00000	/src/testdir/build/lua-master/source/lapi.c:1291
24	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	58	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
18	18	1 : View List ['findvararg']	18	18	luaG_findlocal	call site: 03510	/src/testdir/build/lua-master/source/ldebug.c:202
12	12	2 : View List ['__asan_handle_no_return', '__asan_report_load8']	12	9674	resume	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:915

Runtime coverage analysis

Covered functions

1031

Functions that are reachable but not covered

52

Reachable functions

670

Percentage of reachable functions covered

92.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_loadstring_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	13
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	57
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	25
/src/testdir/build/lua-master/source/linit.c	1
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_loadbuffer_proto_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1085	14.8%
gold	[1:9]	16	0.21%
yellow	[10:29]	22	0.30%
greenyellow	[30:49]	29	0.39%
lawngreen	50+	6165	84.2%
All colors	7317	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9748	9748	1 : View List ['settabss']	39050	39050	db_getinfo	call site: 00000	/src/testdir/build/lua-master/source/ldblib.c:186
9716	9716	2 : View List ['settabsb', 'settabsi']	19584	19584	db_getinfo	call site: 00000	/src/testdir/build/lua-master/source/ldblib.c:194
7017	7017	1 : View List ['globalstatfunc']	7045	14096	statement	call site: 05662	/src/testdir/build/lua-master/source/lparser.c:2053
5642	20298	4 : View List ['loadfunc', 'lua_pushstring', 'lua_pushfstring', 'checkload']	5642	20298	searcher_Croot	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:590
5642	10696	2 : View List ['loadfunc', 'checkload']	5642	10696	searcher_C	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:577
5455	5455	1 : View List ['addfield']	5461	10487	tconcat	call site: 00000	/src/testdir/build/lua-master/source/ltablib.c:179
4932	4932	1 : View List ['treatstackoption']	4932	4932	db_getinfo	call site: 00000	/src/testdir/build/lua-master/source/ldblib.c:200
4824	4824	1 : View List ['codeextraarg']	4826	9654	luaK_setlist	call site: 06100	/src/testdir/build/lua-master/source/lcode.c:1848
4824	4824	1 : View List ['codeextraarg']	4824	9650	luaK_codek	call site: 05861	/src/testdir/build/lua-master/source/lcode.c:461
4812	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	4846	9634	luaD_throw	call site: 00832	/src/testdir/build/lua-master/source/ldo.c:118
4794	4794	2 : View List ['__asan_report_load8', 'rethook']	4794	4829	moveresults	call site: 01749	/src/testdir/build/lua-master/source/ldo.c:565
55	68	2 : View List ['lua_pushboolean', 'lua_getiuservalue']	55	68	db_getuservalue	call site: 00000	/src/testdir/build/lua-master/source/ldblib.c:68

Runtime coverage analysis

Covered functions

3450

Functions that are reachable but not covered

97

Reachable functions

833

Percentage of reachable functions covered

88.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_loadbuffer_proto/luaL_loadbuffer_proto_test.cc	5
/src/testdir/build/lua-master/source/lauxlib.c	12
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	57
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	25
/src/testdir/tests/capi/luaL_loadbuffer_proto/serializer.cc	75
/src/testdir/build/lua-master/source/linit.c	1
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_bufflen_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3673	73.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	11	0.22%
lawngreen	50+	1288	25.9%
All colors	4972	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04779	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01205	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01294	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 04914	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02591	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00948	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04767	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00927	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02584	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00921	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02587	/src/testdir/build/lua-master/source/ltable.c:726
109	109	3 : View List ['__asan_report_store4', '__asan_report_load4', 'mainpositionfromnode']	155	155	insertkey	call site: 02437	/src/testdir/build/lua-master/source/ltable.c:866

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

241

Reachable functions

422

Percentage of reachable functions covered

42.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_bufflen_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	21
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	34

Fuzzer: luaL_traceback_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3755	73.8%
gold	[1:9]	1	0.01%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1332	26.1%
All colors	5088	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04787	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01203	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01292	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 05030	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02589	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00946	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04775	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00925	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02582	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00919	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:726
50	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	52	4840	luaH_setint	call site: 04297	/src/testdir/build/lua-master/source/ltable.c:1208

Runtime coverage analysis

Covered functions

190

Functions that are reachable but not covered

252

Reachable functions

438

Percentage of reachable functions covered

42.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_traceback_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	28
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	58
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	40

Fuzzer: luaL_loadbufferx_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3321	48.0%
gold	[1:9]	26	0.37%
yellow	[10:29]	42	0.60%
greenyellow	[30:49]	19	0.27%
lawngreen	50+	3502	50.6%
All colors	6910	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4812	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	4846	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01203	/src/testdir/build/lua-master/source/lgc.c:1472
4792	4792	2 : View List ['__asan_memcpy', 'luaD_callnoyield']	4926	14502	luaG_errormsg	call site: 01592	/src/testdir/build/lua-master/source/ldebug.c:833
4790	4790	2 : View List ['__asan_report_load4', 'luaD_errerr']	4792	4792	luaE_checkcstack	call site: 01370	/src/testdir/build/lua-master/source/lstate.c:132
184	184	1 : View List ['reinsertOldSlice']	194	10075	luaH_resize	call site: 02585	/src/testdir/build/lua-master/source/ltable.c:726
28	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	30	4840	luaH_setint	call site: 04297	/src/testdir/build/lua-master/source/ltable.c:1208
10	18	4 : View List ['__asan_report_load8', '__asan_report_load4', '__asan_report_store8', 'luaM_free_']	10	18	luaE_shrinkCI	call site: 01358	/src/testdir/build/lua-master/source/lstate.c:107
8	8	3 : View List ['__asan_report_load1', '__asan_handle_no_return', '__asan_report_load8']	8	8	equalkey	call site: 02284	/src/testdir/build/lua-master/source/ltable.c:258
4	4	1 : View List ['__asan_memcpy']	50	50	luaH_finishset	call site: 02509	/src/testdir/build/lua-master/source/ltable.c:1157
4	4	2 : View List ['__asan_report_store8', '__asan_report_store1']	4	4792	luaH_finishset	call site: 02518	/src/testdir/build/lua-master/source/ltable.c:1164
4	4	1 : View List ['__asan_report_load8']	4	4	checkbuffer	call site: 04504	/src/testdir/build/lua-master/source/lzio.c:52
2	9578	3 : View List ['__asan_handle_no_return', 'luaO_pushfstring', 'luaD_throw']	2	9578	checkmode	call site: 04489	/src/testdir/build/lua-master/source/ldo.c:1096

Runtime coverage analysis

Covered functions

453

Functions that are reachable but not covered

200

Reachable functions

647

Percentage of reachable functions covered

69.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_loadbufferx_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	10
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	16
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	8
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_loadbuffer_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	731	10.3%
gold	[1:9]	88	1.24%
yellow	[10:29]	49	0.69%
greenyellow	[30:49]	49	0.69%
lawngreen	50+	6178	87.0%
All colors	7095	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5642	20298	4 : View List ['loadfunc', 'lua_pushstring', 'lua_pushfstring', 'checkload']	5642	20298	searcher_Croot	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:590
5642	10696	2 : View List ['loadfunc', 'checkload']	5642	10696	searcher_C	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:577
4814	9613	2 : View List ['getaddr_', 'luaS_newextlstr']	4890	14683	loadString	call site: 04840	/src/testdir/build/lua-master/source/lundump.c:169
4814	4814	1 : View List ['getaddr_']	4842	38716	loadDebug	call site: 04913	/src/testdir/build/lua-master/source/lundump.c:298
4814	4814	1 : View List ['getaddr_']	4818	4818	loadCode	call site: 04790	/src/testdir/build/lua-master/source/lundump.c:190
4812	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	4846	9634	luaD_throw	call site: 00829	/src/testdir/build/lua-master/source/ldo.c:118
4794	4794	2 : View List ['__asan_report_load8', 'rethook']	4794	4829	moveresults	call site: 01748	/src/testdir/build/lua-master/source/ldo.c:565
32	4820	5 : View List ['__asan_handle_no_return', '__asan_report_store1', 'luaS_newlstr', '__asan_report_store8', '__asan_report_load1']	48	4836	lua_concat	call site: 00000	/src/testdir/build/lua-master/source/lapi.c:1291
8	36817	9 : View List ['luaL_addstring', 'luaL_pushresult', 'luaL_buffinit', 'lua_pushstring', 'luaL_prepbuffsize', '__asan_set_shadow_f8', '__asan_report_store1', 'luaL_addlstring', 'strstr']	16	46473	setpath	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:282
6	6	1 : View List ['__asan_report_load4']	36	4865	check_readonly	call site: 06463	/src/testdir/build/lua-master/source/lparser.c:305
6	6	2 : View List ['__asan_report_store4', 'getc']	6	6	skipcomment	call site: 00000	/src/testdir/build/lua-master/source/lauxlib.c:797
6	6	3 : View List ['__asan_report_store8', '__asan_report_load8', 'fread']	6	6	getF	call site: 00000	/src/testdir/build/lua-master/source/lauxlib.c:754

Runtime coverage analysis

Covered functions

896

Functions that are reachable but not covered

58

Reachable functions

669

Percentage of reachable functions covered

91.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_loadbuffer_test.c	1
/src/testdir/build/lua-master/source/lauxlib.c	12
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	57
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	25
/src/testdir/build/lua-master/source/linit.c	1
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Fuzzer: luaL_addgsub_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3654	73.2%
gold	[1:9]	2	0.04%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1330	26.6%
All colors	4986	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4832	9620	4 : View List ['luaF_newCclosure', '__asan_report_load1', '__asan_memcpy', 'luaC_step']	4904	9692	lua_pushcclosure	call site: 04781	/src/testdir/build/lua-master/source/lapi.c:605
4812	4818	4 : View List ['setminordebt', '__asan_report_load1', 'atomic2gen', 'luaO_applyparam']	4824	4830	checkmajorminor	call site: 01205	/src/testdir/build/lua-master/source/lgc.c:1472
4790	4790	2 : View List ['__asan_report_load4', 'luaS_resize']	4790	4790	checkSizes	call site: 01294	/src/testdir/build/lua-master/source/lgc.c:937
4790	4790	2 : View List ['__asan_handle_no_return', 'luaD_throw']	4790	4790	luaS_newextlstr	call site: 04919	/src/testdir/build/lua-master/source/lstring.c:327
4790	4790	2 : View List ['luaG_runerror', '__asan_handle_no_return']	4790	4790	setnodevector	call site: 02591	/src/testdir/build/lua-master/source/ltable.c:611
4788	4788	1 : View List ['growstrtab']	4820	9608	internshrstr	call site: 00948	/src/testdir/build/lua-master/source/lstring.c:231
4788	4788	1 : View List ['luaD_growstack']	4796	4796	lua_checkstack	call site: 04769	/src/testdir/build/lua-master/source/lapi.c:115
4788	4788	1 : View List ['luaV_execute']	4792	4792	ccall	call site: 00927	/src/testdir/build/lua-master/source/ldo.c:745
4788	4788	1 : View List ['luaG_runerror']	4790	4790	luaH_resize	call site: 02584	/src/testdir/build/lua-master/source/ltable.c:721
4788	4788	1 : View List ['luaD_call']	4788	4788	callclosemethod	call site: 00921	/src/testdir/build/lua-master/source/lfunc.c:116
184	184	1 : View List ['reinsertOldSlice']	4982	10075	luaH_resize	call site: 02587	/src/testdir/build/lua-master/source/ltable.c:726
50	4838	4 : View List ['rawfinishnodeset', '__asan_report_store8', 'luaH_newkey', 'getintfromhash']	52	4840	luaH_setint	call site: 04299	/src/testdir/build/lua-master/source/ltable.c:1208

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

241

Reachable functions

424

Percentage of reachable functions covered

43.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/luaL_addgsub_test.cc	1
/src/testdir/build/lua-master/source/lauxlib.c	22
/src/testdir/build/lua-master/source/lstate.c	19
/src/testdir/build/lua-master/source/lobject.c	21
/src/testdir/build/lua-master/source/ldo.c	27
/src/testdir/build/lua-master/source/lmem.c	5
/src/testdir/build/lua-master/source/lgc.c	74
/src/testdir/build/lua-master/source/ltable.c	56
/src/testdir/build/lua-master/source/lfunc.c	15
/src/testdir/build/lua-master/source/lstring.c	19
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	41
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	1
/src/testdir/build/lua-master/source/llex.c	1
/src/testdir/build/lua-master/source/lapi.c	34

Fuzzer: lua_load_test

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	780	10.9%
gold	[1:9]	52	0.73%
yellow	[10:29]	34	0.47%
greenyellow	[30:49]	57	0.80%
lawngreen	50+	6176	86.9%
All colors	7099	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5642	20298	4 : View List ['loadfunc', 'lua_pushstring', 'lua_pushfstring', 'checkload']	5642	20298	searcher_Croot	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:590
5642	10696	2 : View List ['loadfunc', 'checkload']	5642	10696	searcher_C	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:577
4794	4794	2 : View List ['__asan_handle_no_return', 'luaD_throwbaselevel']	4794	4794	lua_closethread	call site: 00000	/src/testdir/build/lua-master/source/lstate.c:329
32	4820	5 : View List ['__asan_handle_no_return', '__asan_report_store1', 'luaS_newlstr', '__asan_report_store8', '__asan_report_load1']	48	4836	lua_concat	call site: 00000	/src/testdir/build/lua-master/source/lapi.c:1291
24	9600	5 : View List ['luaE_resetthread', '__asan_memcpy', 'luaD_throw', '__asan_report_load1', 'abort']	58	9634	luaD_throw	call site: 00830	/src/testdir/build/lua-master/source/ldo.c:118
12	12	2 : View List ['__asan_handle_no_return', '__asan_report_load8']	12	9674	resume	call site: 00000	/src/testdir/build/lua-master/source/ldo.c:915
8	36817	9 : View List ['luaL_addstring', 'luaL_pushresult', 'luaL_buffinit', 'lua_pushstring', 'luaL_prepbuffsize', '__asan_set_shadow_f8', '__asan_report_store1', 'luaL_addlstring', 'strstr']	16	46473	setpath	call site: 00000	/src/testdir/build/lua-master/source/loadlib.c:282
6	4794	4 : View List ['__asan_report_store4', '__asan_report_load4', '__asan_handle_no_return', 'luaD_throw']	6	4794	luaG_traceexec	call site: 02015	/src/testdir/build/lua-master/source/ldebug.c:963
6	6	2 : View List ['__asan_report_store4', 'getc']	6	6	skipcomment	call site: 00000	/src/testdir/build/lua-master/source/lauxlib.c:797
6	6	3 : View List ['memcmp', 'memchr', '__asan_report_load1']	6	6	lmemfind	call site: 00000	/src/testdir/build/lua-master/source/lstrlib.c:678
4	4792	2 : View List ['__asan_memcpy', 'luaD_callnoyield']	138	14502	luaG_errormsg	call site: 01592	/src/testdir/build/lua-master/source/ldebug.c:833
4	4	2 : View List ['__asan_report_store8', '__asan_report_load8']	4	4	findvararg	call site: 03512	/src/testdir/build/lua-master/source/ldebug.c:189

Runtime coverage analysis

Covered functions

942

Functions that are reachable but not covered

68

Reachable functions

669

Percentage of reachable functions covered

89.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/testdir/tests/capi/lua_load_test.cc	2
/src/testdir/build/lua-master/source/lauxlib.c	10
/src/testdir/build/lua-master/source/lstate.c	20
/src/testdir/build/lua-master/source/lobject.c	24
/src/testdir/build/lua-master/source/ldo.c	31
/src/testdir/build/lua-master/source/lmem.c	8
/src/testdir/build/lua-master/source/lgc.c	71
/src/testdir/build/lua-master/source/ltable.c	57
/src/testdir/build/lua-master/source/lfunc.c	17
/src/testdir/build/lua-master/source/lstring.c	18
/src/testdir/build/lua-master/source/ltm.c	15
/src/testdir/build/lua-master/source/ldebug.c	34
/src/testdir/build/lua-master/source/lvm.c	29
/src/testdir/build/lua-master/source/lopcodes.c	2
/src/testdir/build/lua-master/source/llex.c	25
/src/testdir/build/lua-master/source/lapi.c	25
/src/testdir/build/lua-master/source/linit.c	1
/src/testdir/build/lua-master/source/lzio.c	5
/src/testdir/build/lua-master/source/lundump.c	23
/src/testdir/build/lua-master/source/lparser.c	105
/src/testdir/build/lua-master/source/lcode.c	105

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
luaB_cowrap	/src/testdir/build/lua-master/source/lcorolib.c	1	['N/A']	208	0	18	3	2	396	0	5643	249
str_gsub	/src/testdir/build/lua-master/source/lstrlib.c	1	['N/A']	173	0	440	57	18	447	0	5968	227
io_lines	/src/testdir/build/lua-master/source/liolib.c	1	['N/A']	175	0	98	12	5	452	0	5909	159
str_format	/src/testdir/build/lua-master/source/lstrlib.c	1	['N/A']	173	0	712	99	23	439	0	5915	135
luaB_loadfile	/src/testdir/build/lua-master/source/lbaselib.c	1	['N/A']	172	0	53	3	2	678	0	8102	116
sort	/src/testdir/build/lua-master/source/ltablib.c	1	['N/A']	171	0	78	12	5	395	0	5512	112
searcher_Croot	/src/testdir/build/lua-master/source/loadlib.c	1	['N/A']	174	0	110	12	6	442	0	5851	90
str_pack	/src/testdir/build/lua-master/source/lstrlib.c	1	['N/A']	172	0	818	84	24	428	0	5841	83
__lua_getiuservalue(lua_State*,FuzzedDataProvider*)	/src/testdir/tests/capi/torture_test.cc	2	['N/A', 'N/A']	41	0	58	7	2	332	0	4905	68
db_sethook	/src/testdir/build/lua-master/source/ldblib.c	1	['N/A']	173	0	173	16	7	401	0	5605	51

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

963 / 1322

Cyclomatic complexity statically reachable by fuzzers

11354 / 13100

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/testdir/tests/capi/lua_stringtonumber_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaH_new', 'luaS_new', 'callallpendingfinalizers', 'freeobj', 'luaO_str2num', 'luaH_resize', 'separatetobefnz', 'internshrstr', 'luaF_closeupval', 'luaF_close']

/src/testdir/tests/capi/lua_dump_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaV_tointegerns', 'luaV_equalobj', 'luaD_reallocstack', 'luaF_newproto', 'luaH_new', 'luaO_str2num', 'luaP_isIT', 'luaH_pset', 'luaF_newLclosure', 'luaH_get']

/src/testdir/tests/capi/luaL_gsub_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'getgeneric', 'genlink']

/src/testdir/tests/capi/luaL_buffaddr_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'getgeneric', 'genlink']

/src/testdir/tests/capi/torture_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaV_tointegerns', 'LEnum', 'luaH_new', 'luaD_precall', 'luaV_tonumber_', 'luaP_isIT', 'luaH_pset', 'luaH_get', 'genlink', 'checkmajorminor']

/src/testdir/tests/capi/luaL_buffsub_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'getgeneric', 'genlink']

/src/fuzz_lua.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['genlink', 'checkmajorminor', 'luaS_newextlstr', 'luaF_newproto', 'pushfuncname', 'luaV_execute', 'checkmode', 'luaV_equalobj']

/src/testdir/tests/capi/luaL_dostring_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaV_equalobj', 'equalkey', 'traversetable', 'genlink', 'luaH_finishset', 'luaC_fullgc', 'iscleared', 'addnum2buff', 'luaV_execute', 'checkclosemth']

/src/testdir/tests/capi/luaL_loadstring_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaV_equalobj', 'equalkey', 'traversetable', 'genlink', 'luaH_finishset', 'luaC_fullgc', 'iscleared', 'luaV_execute', 'correctgraylist', 'numarith']

/src/testdir/tests/capi/luaL_loadbuffer_proto/luaL_loadbuffer_proto_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['genlink', 'luaS_newextlstr', 'luaF_newproto', 'luaV_equalobj', 'localstat', 'luaV_execute', 'precallC', 'equalkey', 'luaK_dischargevars']

/src/testdir/tests/capi/luaL_bufflen_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'getgeneric', 'genlink']

/src/testdir/tests/capi/luaL_traceback_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'luaL_traceback', 'getgeneric']

/src/testdir/tests/capi/luaL_loadbufferx_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaV_tointegerns', 'luaV_equalobj', 'luaD_reallocstack', 'luaF_newproto', 'luaH_new', 'luaO_str2num', 'luaP_isIT', 'luaH_pset', 'luaF_newLclosure', 'luaH_get']

/src/testdir/tests/capi/luaL_loadbuffer_test.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['genlink', 'luaV_equalobj', 'precallC', 'equalkey', 'luaD_poscall', 'traversetable', 'atomic', 'luaP_isIT', 'luaH_finishset', 'typeerror']

/src/testdir/tests/capi/luaL_addgsub_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaF_newtbcupval', 'luaH_new', 'luaS_new', 'luaV_finishset', 'luaD_precall', 'luaS_newlstr', 'luaD_callnoyield', 'newbuffsize', 'getgeneric', 'genlink']

/src/testdir/tests/capi/lua_load_test.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['luaS_newextlstr', 'luaF_newproto', 'luaV_equalobj', 'luaV_finishset', 'equalkey', 'luaD_pretailcall', 'traversetable', 'atomic', 'genlink', 'luaG_errormsg']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
luaV_finishOp	54	18	33.33%	['lua_load_test', 'luaL_loadstring_test', 'luaL_dostring_test']
byteoffset	46	23	50.0%	['luaL_loadbuffer_proto_test']
google::protobuf::DescriptorBuilder::AddSymbol(std::__1::basic_string ,std::__1::allocator >const&,voidconst*,std::__1::basic_string ,std::__1::allocator >const&,google::protobuf::Messageconst&,google::protobuf::Symbol)	40	8	20.0%
google::protobuf::DescriptorBuilder::BuildFile(google::protobuf::FileDescriptorProtoconst&)	49	21	42.85%
google::protobuf::DescriptorBuilder::BuildFileImpl(google::protobuf::FileDescriptorProtoconst&,google::protobuf::internal::FlatAllocator&)	201	80	39.80%
google::protobuf::DescriptorBuilder::BuildMessage(google::protobuf::DescriptorProtoconst&,google::protobuf::Descriptorconst*,google::protobuf::Descriptor*,google::protobuf::internal::FlatAllocator&)	135	68	50.37%
google::protobuf::DescriptorBuilder::BuildFieldOrExtension(google::protobuf::FieldDescriptorProtoconst&,google::protobuf::Descriptor*,google::protobuf::FieldDescriptor*,bool,google::protobuf::internal::FlatAllocator&)	232	105	45.25%
google::protobuf::DescriptorBuilder::BuildEnum(google::protobuf::EnumDescriptorProtoconst&,google::protobuf::Descriptorconst*,google::protobuf::EnumDescriptor*,google::protobuf::internal::FlatAllocator&)	84	37	44.04%
google::protobuf::DescriptorBuilder::BuildEnumValue(google::protobuf::EnumValueDescriptorProtoconst&,google::protobuf::EnumDescriptorconst*,google::protobuf::EnumValueDescriptor*,google::protobuf::internal::FlatAllocator&)	43	21	48.83%
google::protobuf::DescriptorBuilder::CrossLinkField(google::protobuf::FieldDescriptor*,google::protobuf::FieldDescriptorProtoconst&)	193	53	27.46%
google::protobuf::FileDescriptorProto::Clear()	33	15	45.45%
google::protobuf::FileDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	171	64	37.42%
google::protobuf::DescriptorProto_ExtensionRange::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	53	28	52.83%
google::protobuf::OneofDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	48	24	50.0%
google::protobuf::EnumDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	88	35	39.77%
google::protobuf::FileOptions::Clear()	55	13	23.63%
google::protobuf::FileOptions::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	241	88	36.51%
google::protobuf::FileOptions::_InternalSerialize(unsignedchar*,google::protobuf::io::EpsCopyOutputStream*)const	139	76	54.67%
google::protobuf::FieldOptions::_InternalParse(charconst*,google::protobuf::internal::ParseContext*)	111	28	25.22%
google::protobuf::FieldOptions::_InternalSerialize(unsignedchar*,google::protobuf::io::EpsCopyOutputStream*)const	48	24	50.0%
google::protobuf::Reflection::FieldSize(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const	38	15	39.47%
google::protobuf::Reflection::ClearOneof(google::protobuf::Message*,google::protobuf::OneofDescriptorconst*)const	31	5	16.12%
google::protobuf::internal::IsDescendant(google::protobuf::Message&,google::protobuf::Messageconst&)	37	7	18.91%
google::protobuf::Reflection::HasBit(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const	50	5	10.0%
google::protobuf::internal::EpsCopyInputStream::NextBuffer(int,int)	41	12	29.26%
google::protobuf::internal::(anonymousnamespace)::UTF8GenericScan(google::protobuf::internal::UTF8StateMachineObjconst*,charconst*,int,int*)	72	3	4.166%
google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*)	199	107	53.76%
google::protobuf::TextFormat::Parser::ParserImpl::ConsumeFieldValue(google::protobuf::Message*,google::protobuf::Reflectionconst*,google::protobuf::FieldDescriptorconst*)	118	51	43.22%
voidprotobuf_mutator::FieldFunction ::operator() (protobuf_mutator::FieldInstanceconst&)const	39	15	38.46%
lua_grammar::Expression::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&)	62	12	19.35%
lua_grammar::BinaryOperator::MergeImpl(google::protobuf::Message&,google::protobuf::Messageconst&)	97	12	12.37%

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/testdir/build/lua-master/source/lstrlib.c	[]	[]
/src/testdir/tests/capi/luaL_loadstring_test.c	['luaL_loadstring_test']	['luaL_loadstring_test']
/src/testdir/build/lua-master/source/lstring.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lcode.c	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lvm.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/tests/capi/luaL_buffsub_test.cc	['luaL_buffsub_test']	['luaL_buffsub_test']
/src/testdir/tests/capi/luaL_loadbuffer_proto/serializer.cc	['luaL_loadbuffer_proto_test']	['luaL_loadbuffer_proto_test']
/src/testdir/build/lua-master/source/llex.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/usr/local/bin/../include/c++/v1/string	[]	[]
/src/testdir/build/lua-master/source/lobject.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/ltm.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lgc.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/ldebug.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_dump_test', 'torture_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lparser.c	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/tests/capi/luaL_loadbuffer_proto/luaL_loadbuffer_proto_test.cc	['luaL_loadbuffer_proto_test']	['luaL_loadbuffer_proto_test']
/src/testdir/build/lua-master/source/ldblib.c	[]	[]
/src/testdir/tests/capi/luaL_loadbuffer_test.c	['luaL_loadbuffer_test']	['luaL_loadbuffer_test']
/src/testdir/build/lua-master/source/lutf8lib.c	[]	[]
/src/testdir/tests/capi/luaL_loadbufferx_test.c	['luaL_loadbufferx_test']	['luaL_loadbufferx_test']
/usr/local/bin/../include/c++/v1/stdexcept	[]	[]
/src/testdir/tests/capi/luaL_traceback_test.c	['luaL_traceback_test']	['luaL_traceback_test']
/src/testdir/tests/capi/luaL_gsub_test.cc	['luaL_gsub_test']	['luaL_gsub_test']
/src/testdir/build/lua-master/source/ltable.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/tests/capi/luaL_addgsub_test.cc	['luaL_addgsub_test']	['luaL_addgsub_test']
/src/testdir/build/lua-master/source/lundump.c	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']	['lua_dump_test', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lbaselib.c	[]	[]
/src/testdir/build/lua-master/source/lopcodes.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_dump_test', 'torture_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lauxlib.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lmem.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/linit.c	['luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbuffer_test', 'lua_load_test']	['luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lapi.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/ldo.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/lcorolib.c	[]	[]
/src/testdir/tests/capi/luaL_bufflen_test.c	['luaL_bufflen_test']	['luaL_bufflen_test']
/src/testdir/build/lua-master/source/liolib.c	[]	[]
/src/testdir/build/lua-master/source/ltablib.c	[]	[]
/src/testdir/build/lua-master/source/lmathlib.c	[]	[]
/src/testdir/build/lua-master/source/loslib.c	[]	[]
/src/testdir/build/lua-master/source/ldump.c	['lua_dump_test']	['lua_dump_test']
/src/testdir/tests/capi/lua_stringtonumber_test.c	['lua_stringtonumber_test']	['lua_stringtonumber_test']
/src/testdir/build/lua-master/source/lfunc.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/build/lua-master/source/loadlib.c	[]	[]
/src/fuzz_lua.c	['fuzz_lua']	['fuzz_lua']
/src/testdir/tests/capi/luaL_dostring_test.c	['luaL_dostring_test']	['luaL_dostring_test']
/src/testdir/tests/capi/torture_test.cc	['torture_test']	['torture_test']
/src/testdir/tests/capi/lua_load_test.cc	['lua_load_test']	['lua_load_test']
/src/testdir/build/lua-master/source/lstate.c	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']	['lua_stringtonumber_test', 'lua_dump_test', 'luaL_gsub_test', 'luaL_buffaddr_test', 'torture_test', 'luaL_buffsub_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_bufflen_test', 'luaL_traceback_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'luaL_addgsub_test', 'lua_load_test']
/src/testdir/tests/capi/lua_dump_test.c	['lua_dump_test']	['lua_dump_test']
/src/testdir/build/lua-master/source/lzio.c	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']	['lua_dump_test', 'fuzz_lua', 'luaL_dostring_test', 'luaL_loadstring_test', 'luaL_loadbuffer_proto_test', 'luaL_loadbufferx_test', 'luaL_loadbuffer_test', 'lua_load_test']
/src/testdir/tests/capi/luaL_buffaddr_test.c	['luaL_buffaddr_test']	['luaL_buffaddr_test']

Directories in report

Directory
/src/testdir/tests/capi/
/src/testdir/tests/capi/luaL_loadbuffer_proto/
/src/testdir/build/lua-master/source/
/usr/local/bin/../include/c++/v1/
/src/