Fuzz introspector: fuzz_regexp
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 8 2 :

['re_parse_error', 'pstrcpy']

0 14 lre_compile call site: 00373 /src/quickjs/libregexp.c:1786
0 4 1 :

['re_parse_error']

0 4 re_emit_range call site: 00290 /src/quickjs/libregexp.c:747
0 2 1 :

['is_digit']

0 2 lre_parse_escape call site: 00066 /src/quickjs/libregexp.c:495
0 0 None 366 1397 lre_exec_backtrack call site: 00391 /src/quickjs/libregexp.c:2080
0 0 None 366 1397 lre_exec_backtrack call site: 00398 /src/quickjs/libregexp.c:2124
0 0 None 366 1397 lre_exec_backtrack call site: 00400 /src/quickjs/libregexp.c:2133
0 0 None 366 1397 lre_exec_backtrack call site: 00415 /src/quickjs/libregexp.c:2235
0 0 None 366 1397 lre_exec_backtrack call site: 00419 /src/quickjs/libregexp.c:2249
0 0 None 366 1397 lre_exec_backtrack call site: 00423 /src/quickjs/libregexp.c:2269
0 0 None 366 1397 lre_exec_backtrack call site: 00430 /src/quickjs/libregexp.c:2309
0 0 None 58 923 re_parse_term call site: 00114 /src/quickjs/libregexp.c:1143
0 0 None 58 903 re_parse_term call site: 00306 /src/quickjs/libregexp.c:1366

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 lre_compile [function] [call site] 00001
2 dbuf_init2 [function] [call site] 00002
2 lre_realloc [function] [call site] 00003
3 realloc [call site] 00004
2 dbuf_init2 [function] [call site] 00005
2 lre_realloc [function] [call site] 00006
2 dbuf_putc [function] [call site] 00007
3 dbuf_put [function] [call site] 00008
4 dbuf_realloc [function] [call site] 00009
4 memcpy_no_ub [function] [call site] 00010
2 dbuf_putc [function] [call site] 00011
2 dbuf_putc [function] [call site] 00012
2 dbuf_put_u32 [function] [call site] 00013
3 dbuf_put [function] [call site] 00014
2 re_emit_op_u32 [function] [call site] 00015
3 dbuf_putc [function] [call site] 00016
3 dbuf_put_u32 [function] [call site] 00017
2 re_emit_op [function] [call site] 00018
3 dbuf_putc [function] [call site] 00019
2 re_emit_op_u32 [function] [call site] 00020
2 re_emit_op_u8 [function] [call site] 00021
3 dbuf_putc [function] [call site] 00022
3 dbuf_putc [function] [call site] 00023
2 re_parse_disjunction [function] [call site] 00024
3 lre_check_stack_overflow [function] [call site] 00025
3 re_parse_error [function] [call site] 00026
4 vsnprintf [call site] 00027
3 re_parse_alternative [function] [call site] 00028
4 re_parse_term [function] [call site] 00029
5 re_emit_op [function] [call site] 00030
5 re_emit_op [function] [call site] 00031
5 re_emit_op [function] [call site] 00032
5 re_emit_op [function] [call site] 00033
5 re_emit_op [function] [call site] 00034
5 re_parse_error [function] [call site] 00035
5 is_digit [function] [call site] 00036
5 parse_digits [function] [call site] 00037
5 is_digit [function] [call site] 00038
5 parse_digits [function] [call site] 00039
5 re_parse_error [function] [call site] 00040
5 re_parse_disjunction [function] [call site] 00041
6 dbuf_insert [function] [call site] 00042
7 dbuf_realloc [function] [call site] 00043
6 re_parse_out_of_memory [function] [call site] 00044
7 re_parse_error [function] [call site] 00045
6 put_u32 [function] [call site] 00046
6 re_emit_op_u32 [function] [call site] 00047
6 re_parse_alternative [function] [call site] 00048
7 dbuf_realloc [function] [call site] 00049
6 put_u32 [function] [call site] 00050
5 re_parse_expect [function] [call site] 00051
6 re_parse_error [function] [call site] 00052
5 re_emit_op_u32 [function] [call site] 00053
5 re_parse_disjunction [function] [call site] 00054
5 re_parse_expect [function] [call site] 00055
5 re_emit_op [function] [call site] 00056
5 dbuf_error [function] [call site] 00057
5 put_u32 [function] [call site] 00058
5 re_parse_group_name [function] [call site] 00059
6 lre_parse_escape [function] [call site] 00060
7 from_hex [function] [call site] 00061
7 from_hex [function] [call site] 00062
7 is_hi_surrogate [function] [call site] 00063
7 from_hex [function] [call site] 00064
7 is_lo_surrogate [function] [call site] 00065
7 from_surrogate [function] [call site] 00066
7 is_digit [function] [call site] 00067
6 unicode_from_utf8 [function] [call site] 00068
6 is_hi_surrogate [function] [call site] 00069
6 unicode_from_utf8 [function] [call site] 00070
6 is_lo_surrogate [function] [call site] 00071
6 from_surrogate [function] [call site] 00072
6 lre_js_is_ident_first [function] [call site] 00073
7 lre_is_id_start_byte [function] [call site] 00074
7 lre_is_id_start [function] [call site] 00075
8 lre_is_in_table [function] [call site] 00076
9 get_index_pos [function] [call site] 00077
10 get_le24 [function] [call site] 00078
10 get_le24 [function] [call site] 00079
10 get_le24 [function] [call site] 00080
10 get_le24 [function] [call site] 00081
6 lre_js_is_ident_next [function] [call site] 00082
7 lre_is_id_continue_byte [function] [call site] 00083
7 lre_is_id_continue [function] [call site] 00084
8 lre_is_id_start [function] [call site] 00085
8 lre_is_in_table [function] [call site] 00086
6 unicode_to_utf8 [function] [call site] 00087
5 re_parse_error [function] [call site] 00088
5 find_group_name [function] [call site] 00089
6 strlen [call site] 00090
6 strlen [call site] 00091
6 memcmp [call site] 00092
5 re_parse_error [function] [call site] 00093
5 strlen [call site] 00094
5 dbuf_put [function] [call site] 00095
5 re_parse_error [function] [call site] 00096
5 dbuf_putc [function] [call site] 00097
5 re_parse_error [function] [call site] 00098
5 re_emit_op_u8 [function] [call site] 00099
5 re_parse_disjunction [function] [call site] 00100
5 re_emit_op_u8 [function] [call site] 00101
5 re_parse_expect [function] [call site] 00102
5 re_emit_op [function] [call site] 00103
5 re_has_named_captures [function] [call site] 00104
6 re_count_captures [function] [call site] 00105
7 re_parse_captures [function] [call site] 00106
8 re_parse_group_name [function] [call site] 00107
8 strcmp [call site] 00108
5 re_parse_group_name [function] [call site] 00109
5 re_has_named_captures [function] [call site] 00110
5 find_group_name [function] [call site] 00111
5 re_parse_captures [function] [call site] 00112
5 re_has_named_captures [function] [call site] 00113
5 re_parse_error [function] [call site] 00114
5 is_digit [function] [call site] 00115
5 re_parse_error [function] [call site] 00116
5 parse_digits [function] [call site] 00117
5 re_count_captures [function] [call site] 00118
5 re_parse_error [function] [call site] 00119
5 re_emit_op_u8 [function] [call site] 00120
5 re_parse_char_class [function] [call site] 00121
6 cr_init [function] [call site] 00122
6 lre_realloc [function] [call site] 00123
6 get_class_atom [function] [call site] 00124
7 cr_init_char_range [function] [call site] 00125
8 cr_init [function] [call site] 00126
8 lre_realloc [function] [call site] 00127
8 cr_add_point [function] [call site] 00128
9 cr_realloc [function] [call site] 00129
10 max_int [function] [call site] 00130
8 cr_invert [function] [call site] 00131
9 cr_realloc [function] [call site] 00132
9 cr_compress [function] [call site] 00133
8 cr_free [function] [call site] 00134
7 parse_unicode_property [function] [call site] 00135
8 is_unicode_char [function] [call site] 00136
8 re_parse_error [function] [call site] 00137
8 is_unicode_char [function] [call site] 00138
8 re_parse_error [function] [call site] 00139
8 re_parse_error [function] [call site] 00140
8 strcmp [call site] 00141
8 strcmp [call site] 00142
8 cr_init [function] [call site] 00143
8 lre_realloc [function] [call site] 00144
8 unicode_script [function] [call site] 00145
9 unicode_find_name [function] [call site] 00146
10 strlen [call site] 00147
10 strchr [call site] 00148
10 strlen [call site] 00149
10 memcmp [call site] 00150
9 cr_init [function] [call site] 00151
9 cr_init [function] [call site] 00152
9 cr_add_interval [function] [call site] 00153
10 cr_realloc [function] [call site] 00154
9 cr_add_interval [function] [call site] 00155
9 cr_add_interval [function] [call site] 00156
9 cr_invert [function] [call site] 00157
9 cr_op [function] [call site] 00158
10 abort [call site] 00159
10 cr_add_point [function] [call site] 00160
10 cr_compress [function] [call site] 00161
9 cr_op [function] [call site] 00162
9 cr_free [function] [call site] 00163
9 cr_free [function] [call site] 00164
9 cr_free [function] [call site] 00165
9 cr_free [function] [call site] 00166
8 cr_free [function] [call site] 00167
8 re_parse_error [function] [call site] 00168
8 strcmp [call site] 00169
8 cr_init [function] [call site] 00170
8 lre_realloc [function] [call site] 00171
8 unicode_general_category [function] [call site] 00172
9 unicode_find_name [function] [call site] 00173
9 unicode_general_category1 [function] [call site] 00174
10 cr_add_interval [function] [call site] 00175
10 cr_add_interval [function] [call site] 00176
8 cr_free [function] [call site] 00177
8 re_parse_error [function] [call site] 00178
8 cr_init [function] [call site] 00179
8 lre_realloc [function] [call site] 00180
8 unicode_general_category [function] [call site] 00181
8 cr_free [function] [call site] 00182
8 unicode_prop [function] [call site] 00183
9 unicode_find_name [function] [call site] 00184
9 cr_add_interval [function] [call site] 00185
9 cr_add_interval [function] [call site] 00186
9 unicode_prop_ops [function] [call site] 00187
10 __assert_fail [call site] 00188
10 cr_init [function] [call site] 00189
10 unicode_general_category1 [function] [call site] 00190
10 __assert_fail [call site] 00191
10 cr_init [function] [call site] 00192
10 unicode_prop1 [function] [call site] 00193
11 cr_add_interval [function] [call site] 00194
11 cr_add_interval [function] [call site] 00195
10 __assert_fail [call site] 00196
10 cr_init [function] [call site] 00197
10 unicode_case1 [function] [call site] 00198
11 cr_add_interval [function] [call site] 00199
11 cr_add_interval [function] [call site] 00200
11 cr_add_interval [function] [call site] 00201
11 cr_add_interval [function] [call site] 00202
11 cr_add_interval [function] [call site] 00203
10 __assert_fail [call site] 00204
10 __assert_fail [call site] 00205
10 cr_init [function] [call site] 00206
10 cr_op [function] [call site] 00207
10 cr_free [function] [call site] 00208
10 cr_free [function] [call site] 00209
10 __assert_fail [call site] 00210
10 cr_invert [function] [call site] 00211
10 abort [call site] 00212
10 __assert_fail [call site] 00213
10 cr_copy [function] [call site] 00214
11 cr_realloc [function] [call site] 00215
10 cr_free [function] [call site] 00216
10 cr_free [function] [call site] 00217
9 unicode_prop_ops [function] [call site] 00218
9 unicode_prop_ops [function] [call site] 00219
9 unicode_prop_ops [function] [call site] 00220
9 unicode_prop_ops [function] [call site] 00221
9 unicode_prop_ops [function] [call site] 00222
9 unicode_prop_ops [function] [call site] 00223
9 unicode_prop_ops [function] [call site] 00224
9 unicode_prop_ops [function] [call site] 00225
9 unicode_prop_ops [function] [call site] 00226
9 unicode_case1 [function] [call site] 00227
9 unicode_case1 [function] [call site] 00228
9 unicode_case1 [function] [call site] 00229
9 unicode_prop_ops [function] [call site] 00230
9 unicode_prop_ops [function] [call site] 00231
9 unicode_prop_ops [function] [call site] 00232
9 unicode_prop_ops [function] [call site] 00233
9 unicode_prop1 [function] [call site] 00234
8 cr_free [function] [call site] 00235
8 re_parse_error [function] [call site] 00236
8 cr_invert [function] [call site] 00237
8 cr_free [function] [call site] 00238
8 re_parse_out_of_memory [function] [call site] 00239
7 lre_parse_escape [function] [call site] 00240
7 memchr [call site] 00241
7 re_parse_error [function] [call site] 00242
7 re_parse_error [function] [call site] 00243
7 unicode_from_utf8 [function] [call site] 00244
7 re_parse_error [function] [call site] 00245
6 cr_free [function] [call site] 00246
6 get_class_atom [function] [call site] 00247
6 cr_free [function] [call site] 00248
6 re_parse_error [function] [call site] 00249
6 cr_union_interval [function] [call site] 00250
7 cr_union1 [function] [call site] 00251
8 cr_op [function] [call site] 00252
8 cr_free [function] [call site] 00253
6 cr_union1 [function] [call site] 00254
6 cr_free [function] [call site] 00255
6 cr_union_interval [function] [call site] 00256
6 cr_regexp_canonicalize [function] [call site] 00257
7 cr_init [function] [call site] 00258
7 cr_init [function] [call site] 00259
7 cr_init [function] [call site] 00260
7 cr_init [function] [call site] 00261
7 unicode_case1 [function] [call site] 00262
7 cr_op [function] [call site] 00263
7 cr_invert [function] [call site] 00264
7 cr_op [function] [call site] 00265
7 __assert_fail [call site] 00266
7 lre_case_folding_entry [function] [call site] 00267
8 lre_case_conv_entry [function] [call site] 00268
9 lre_case_conv1 [function] [call site] 00269
10 lre_case_conv [function] [call site] 00270
11 lre_case_conv_entry [function] [call site] 00271
12 lre_case_conv1 [function] [call site] 00272
12 lre_case_conv1 [function] [call site] 00273
12 lre_case_conv1 [function] [call site] 00274
12 lre_case_conv1 [function] [call site] 00275
8 lre_case_conv_entry [function] [call site] 00276
7 cr_add_interval [function] [call site] 00277
7 cr_add_interval [function] [call site] 00278
7 cr_sort_and_remove_overlap [function] [call site] 00279
8 rqsort [function] [call site] 00280
9 exchange_func [function] [call site] 00281
9 exchange_func [function] [call site] 00282
9 heapsortx [function] [call site] 00283
10 exchange_func [function] [call site] 00284
9 med3 [function] [call site] 00285
8 point_cmp [function] [call site] 00286
7 cr_op [function] [call site] 00287
7 cr_free [function] [call site] 00288
6 cr_invert [function] [call site] 00289
6 re_emit_range [function] [call site] 00290
7 re_parse_error [function] [call site] 00291
7 re_emit_op_u32 [function] [call site] 00292
7 re_emit_op_u16 [function] [call site] 00293
8 dbuf_putc [function] [call site] 00294
8 dbuf_put_u16 [function] [call site] 00295
9 dbuf_put [function] [call site] 00296
7 dbuf_put_u16 [function] [call site] 00297
7 dbuf_put_u16 [function] [call site] 00298
7 re_emit_op_u16 [function] [call site] 00299
7 dbuf_put_u32 [function] [call site] 00300
7 dbuf_put_u32 [function] [call site] 00301
6 cr_free [function] [call site] 00302
6 re_parse_out_of_memory [function] [call site] 00303
6 cr_free [function] [call site] 00304
5 re_emit_op [function] [call site] 00305
5 re_emit_op [function] [call site] 00306
5 re_parse_error [function] [call site] 00307
5 get_class_atom [function] [call site] 00308
5 re_emit_op [function] [call site] 00309
5 re_emit_range [function] [call site] 00310
5 lre_canonicalize [function] [call site] 00311
6 lre_case_folding_entry [function] [call site] 00312
5 re_emit_op_u16 [function] [call site] 00313
5 re_emit_op_u32 [function] [call site] 00314
5 re_emit_op [function] [call site] 00315
5 is_digit [function] [call site] 00316
5 parse_digits [function] [call site] 00317
5 is_digit [function] [call site] 00318
5 parse_digits [function] [call site] 00319
5 re_parse_error [function] [call site] 00320
5 re_parse_expect [function] [call site] 00321
5 dbuf_error [function] [call site] 00322
5 re_is_simple_quantifier [function] [call site] 00323
6 get_u16 [function] [call site] 00324
5 re_emit_op [function] [call site] 00325
5 dbuf_insert [function] [call site] 00326
5 dbuf_error [function] [call site] 00327
5 re_need_check_advance [function] [call site] 00328
5 put_u32 [function] [call site] 00329
5 put_u32 [function] [call site] 00330
5 put_u32 [function] [call site] 00331
5 put_u32 [function] [call site] 00332
5 dbuf_insert [function] [call site] 00333
5 dbuf_insert [function] [call site] 00334
5 put_u32 [function] [call site] 00335
5 re_emit_op [function] [call site] 00336
5 re_emit_goto [function] [call site] 00337
6 dbuf_putc [function] [call site] 00338
6 dbuf_put_u32 [function] [call site] 00339
5 dbuf_insert [function] [call site] 00340
5 put_u32 [function] [call site] 00341
5 put_u32 [function] [call site] 00342
5 re_emit_op [function] [call site] 00343
5 re_emit_goto [function] [call site] 00344
5 re_emit_op [function] [call site] 00345
5 re_emit_goto [function] [call site] 00346
5 dbuf_insert [function] [call site] 00347
5 put_u32 [function] [call site] 00348
5 re_emit_goto [function] [call site] 00349
5 re_emit_op [function] [call site] 00350
5 re_emit_op_u32 [function] [call site] 00351
5 dbuf_put_self [function] [call site] 00352
6 dbuf_realloc [function] [call site] 00353
5 re_emit_op [function] [call site] 00354
5 re_emit_op [function] [call site] 00355
5 re_emit_goto [function] [call site] 00356
5 re_emit_op_u32 [function] [call site] 00357
5 re_emit_op_u32 [function] [call site] 00358
5 dbuf_put_self [function] [call site] 00359
5 re_emit_op [function] [call site] 00360
5 re_emit_op [function] [call site] 00361
5 re_emit_goto [function] [call site] 00362
5 re_emit_op [function] [call site] 00363
5 re_parse_out_of_memory [function] [call site] 00364
2 dbuf_free [function] [call site] 00365
2 dbuf_free [function] [call site] 00366
2 pstrcpy [function] [call site] 00367
2 re_emit_op_u8 [function] [call site] 00368
2 re_emit_op [function] [call site] 00369
2 re_parse_error [function] [call site] 00370
2 dbuf_error [function] [call site] 00371
2 re_parse_out_of_memory [function] [call site] 00372
2 compute_stack_size [function] [call site] 00373
3 __assert_fail [call site] 00374
3 __assert_fail [call site] 00375
3 __assert_fail [call site] 00376
3 get_u16 [function] [call site] 00377
3 get_u16 [function] [call site] 00378
2 re_parse_error [function] [call site] 00379
2 put_u32 [function] [call site] 00380
2 dbuf_put [function] [call site] 00381
2 dbuf_free [function] [call site] 00382
1 lre_exec [function] [call site] 00383
2 lre_get_flags [function] [call site] 00384
2 lre_exec_backtrack [function] [call site] 00385
3 get_u32 [function] [call site] 00386
3 is_lo_surrogate [function] [call site] 00387
3 get_u32 [function] [call site] 00388
3 get_u32 [function] [call site] 00389
3 get_u16 [function] [call site] 00390
3 is_hi_surrogate [function] [call site] 00391
3 lre_canonicalize [function] [call site] 00392
3 get_u32 [function] [call site] 00393
3 push_state [function] [call site] 00394
4 lre_realloc [function] [call site] 00395
3 get_u32 [function] [call site] 00396
3 push_state [function] [call site] 00397
3 get_u32 [function] [call site] 00398
3 is_lo_surrogate [function] [call site] 00399
3 is_line_terminator [function] [call site] 00400
3 is_hi_surrogate [function] [call site] 00401
3 is_line_terminator [function] [call site] 00402
3 is_hi_surrogate [function] [call site] 00403
3 is_line_terminator [function] [call site] 00404
3 is_hi_surrogate [function] [call site] 00405
3 __assert_fail [call site] 00406
3 __assert_fail [call site] 00407
3 get_u32 [function] [call site] 00408
3 get_u32 [function] [call site] 00409
3 is_lo_surrogate [function] [call site] 00410
3 is_word_char [function] [call site] 00411
3 is_hi_surrogate [function] [call site] 00412
3 is_word_char [function] [call site] 00413
3 is_hi_surrogate [function] [call site] 00414
3 is_hi_surrogate [function] [call site] 00415
3 lre_canonicalize [function] [call site] 00416
3 lre_canonicalize [function] [call site] 00417
3 is_lo_surrogate [function] [call site] 00418
3 is_lo_surrogate [function] [call site] 00419
3 lre_canonicalize [function] [call site] 00420
3 lre_canonicalize [function] [call site] 00421
3 get_u16 [function] [call site] 00422
3 is_hi_surrogate [function] [call site] 00423
3 lre_canonicalize [function] [call site] 00424
3 get_u16 [function] [call site] 00425
3 get_u16 [function] [call site] 00426
3 get_u16 [function] [call site] 00427
3 get_u16 [function] [call site] 00428
3 get_u16 [function] [call site] 00429
3 is_hi_surrogate [function] [call site] 00430
3 lre_canonicalize [function] [call site] 00431
3 get_u32 [function] [call site] 00432
3 get_u32 [function] [call site] 00433
3 get_u32 [function] [call site] 00434
3 get_u32 [function] [call site] 00435
3 is_lo_surrogate [function] [call site] 00436
3 get_u32 [function] [call site] 00437
3 get_u32 [function] [call site] 00438
3 get_u32 [function] [call site] 00439
3 lre_exec_backtrack [function] [call site] 00440
4 push_state [function] [call site] 00441
4 abort [call site] 00442
2 lre_realloc [function] [call site] 00443
1 lre_get_capture_count [function] [call site] 00444