High level conclusions

Fuzzers reach 26.94% of cyclomatic complexity.

Fuzzers reach 24.38% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

3062 / 12555

Cyclomatic complexity statically reachable by fuzzers

21271 / 78929

Runtime code coverage of functions

2099 / 12555

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: http_parser_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	100.%
All colors	6	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	http_parse_status_line	call site: 00005	/src/tarantool/src/lib/http_parser/http_parser.c:85
0	0	None	0	0	http_parse_status_line	call site: 00005	/src/tarantool/src/lib/http_parser/http_parser.c:91
0	0	None	0	0	http_parse_status_line	call site: 00005	/src/tarantool/src/lib/http_parser/http_parser.c:97
0	0	None	0	0	http_parse_status_line	call site: 00005	/src/tarantool/src/lib/http_parser/http_parser.c:103
0	0	None	0	0	http_parse_status_line	call site: 00005	/src/tarantool/src/lib/http_parser/http_parser.c:109

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

2

Reachable functions

6

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/http_parser_fuzzer.c	1
/src/tarantool/src/lib/http_parser/http_parser.c	3

Fuzzer: csv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	13.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13	86.6%
All colors	15	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	csv_parse_impl	call site: 00007	/src/tarantool/src/lib/csv/csv.c:128
0	0	None	0	0	csv_parse_impl	call site: 00010	/src/tarantool/src/lib/csv/csv.c:142
0	0	None	0	0	csv_parse_impl	call site: 00010	/src/tarantool/src/lib/csv/csv.c:196

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

3

Reachable functions

12

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/csv_fuzzer.c	1
/src/tarantool/src/lib/csv/csv.c	8

Fuzzer: decimal_to_int64_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	15.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	13.1%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	71.0%
All colors	38	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['decSetMaxValue']	2	2	decSetOverflow	call site: 00016	/src/tarantool/third_party/decNumber/decNumber.c:7482
0	121	1 : View List ['decSetSubnormal']	0	192	decFinalize	call site: 00021	/src/tarantool/third_party/decNumber/decNumber.c:7407
0	0	None	0	44	decCompare	call site: 00021	/src/tarantool/third_party/decNumber/decNumber.c:6281
0	0	None	0	44	decCompare	call site: 00021	/src/tarantool/third_party/decNumber/decNumber.c:6306
0	0	1 : View List ['malloc']	0	24	decUnitCompare	call site: 00022	/src/tarantool/third_party/decNumber/decNumber.c:6371
0	0	None	0	24	decApplyRound	call site: 00014	/src/tarantool/third_party/decNumber/decNumber.c:7260
0	0	None	0	12	decFinalize	call site: 00027	/src/tarantool/third_party/decNumber/decNumber.c:7427
0	0	None	0	0	decUnitAddSub	call site: 00018	/src/tarantool/third_party/decNumber/decNumber.c:6464
0	0	None	0	0	decUnitAddSub	call site: 00018	/src/tarantool/third_party/decNumber/decNumber.c:6469
0	0	None	0	0	decUnitAddSub	call site: 00018	/src/tarantool/third_party/decNumber/decNumber.c:6473
0	0	None	0	0	decUnitAddSub	call site: 00018	/src/tarantool/third_party/decNumber/decNumber.c:6513
0	0	None	0	0	decUnitAddSub	call site: 00018	/src/tarantool/third_party/decNumber/decNumber.c:6565

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

6

Reachable functions

25

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/decimal_to_int64_fuzzer.c	1
/src/tarantool/src/trivia/util.h	1
/src/tarantool/src/lib/core/decimal.c	2
/src/tarantool/third_party/decNumber/decNumber.c	14
/src/tarantool/third_party/decNumber/decContext.c	3

Fuzzer: swim_proto_meta_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	432	58.0%
gold	[1:9]	18	2.41%
yellow	[10:29]	15	2.01%
greenyellow	[30:49]	13	1.74%
lawngreen	50+	266	35.7%
All colors	744	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
488	488	1 : View List ['fiber_delete']	488	488	cord_collect_garbage	call site: 00669	/src/tarantool/src/lib/core/fiber.c:1909
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00318	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00432	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00452	/src/tarantool/src/lib/core/clock_lowres.c:69
23	23	3 : View List ['__errno_location', '_say_strerror', 'say_log_level_is_enabled.370']	23	23	signal_stack_free	call site: 00612	/src/tarantool/src/lib/core/fiber.c:260
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00012	/src/tarantool/src/lib/small/small/slab_arena.c:204
10	10	5 : View List ['sigdelset', 'pthread_sigmask', 'sigaddset', 'signalfd', 'sigemptyset']	10	10	ev_signal_stop	call site: 00628	/src/tarantool/third_party/libev/ev.c:4711
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00413	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00261	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00040	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00062	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00319	/src/tarantool/src/lib/core/fiber.c:1223

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

197

Reachable functions

325

Percentage of reachable functions covered

39.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/swim_proto_meta_fuzzer.c	1
/src/tarantool/src/lib/core/memory.c	2
/src/tarantool/src/lib/small/include/small/quota.h	3
/src/tarantool/src/lib/small/small/slab_arena.c	6
/src/tarantool/src/lib/small/include/small/lf_lifo.h	4
/src/tarantool/src/lib/small/include/small/util.h	4
/src/tarantool/src/lib/core/fiber.c	41
/src/tarantool/third_party/libev/ev.c	49
/src/tarantool/third_party/libev/ev_iouring.c	17
/src/tarantool/third_party/libev/ev_epoll.c	5
/src/tarantool/third_party/libev/ev_poll.c	5
/src/tarantool/third_party/libev/ev_select.c	4
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/small/include/small/slab_cache.h	6
/src/tarantool/src/lib/small/small/slab_cache.c	11
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	7
/src/tarantool/src/lib/small/small/mempool.c	8
/src/tarantool/src/lib/salad/mhash.h	2
/src/tarantool/src/lib/core/diag.h	5
/src/tarantool/src/lib/small/include/small/region.h	3
/src/tarantool/src/lib/core/fiber.h	4
/src/tarantool/src/lib/core/clock.c	3
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	3
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	3
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/lib/core/tt_sigaction.c	2
/src/tarantool/src/lib/swim/swim_proto.c	7
/src/tarantool/src/lib/msgpuck/msgpuck.h	8
/src/tarantool/src/lib/core/exception.cc	3
/src/tarantool/src/lib/core/diag.c	6
/src/tarantool/src/lib/core/error_payload.c	1
/src/tarantool/src/lib/swim/swim_proto.h	1
/src/tarantool/third_party/libev/ev.h	2
/src/tarantool/src/lib/core/trigger.h	1
/src/tarantool/src/lib/small/small/region.c	1

Fuzzer: datetime_strptime_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	19.6%
gold	[1:9]	2	1.22%
yellow	[10:29]	5	3.06%
greenyellow	[30:49]	2	1.22%
lawngreen	50+	122	74.8%
All colors	163	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
46	8309	8 : View List ['strlen', 'strlcpy', 'first_wday_of', '__ctype_b_loc', 'timezone_tm_lookup', 'tnt_strptime', 'strncasecmp', 'strtol']	46	8309	tnt_strptime	call site: 00008	/src/tarantool/src/lib/tzcode/strptime.c:150
46	8309	8 : View List ['strlen', 'strlcpy', 'first_wday_of', '__ctype_b_loc', 'timezone_tm_lookup', 'tnt_strptime', 'strncasecmp', 'strtol']	46	8309	tnt_strptime	call site: 00008	/src/tarantool/src/lib/tzcode/strptime.c:169
25	25	1 : View List ['gmtsub']	25	25	localsub	call site: 00147	/src/tarantool/src/lib/tzcode/localtime.c:1431
3	3	1 : View List ['getqzname']	3	150	tzparse	call site: 00090	/src/tarantool/src/lib/tzcode/localtime.c:1106
2	2	1 : View List ['__errno_location']	2	2	tzloadbody	call site: 00068	/src/tarantool/src/lib/tzcode/localtime.c:398
2	2	1 : View List ['update_tzname_etc']	2	2	localsub	call site: 00156	/src/tarantool/src/lib/tzcode/localtime.c:1504
0	289	1 : View List ['tzload']	3	447	tzparse	call site: 00085	/src/tarantool/src/lib/tzcode/localtime.c:1092
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	12	1 : View List ['getnum']	0	12	getsecs	call site: 00087	/src/tarantool/src/lib/tzcode/localtime.c:860
0	0	None	30	467	tzloadbody	call site: 00058	/src/tarantool/src/lib/tzcode/localtime.c:346
0	0	None	30	467	tzloadbody	call site: 00058	/src/tarantool/src/lib/tzcode/localtime.c:352
0	0	None	8	439	tzloadbody	call site: 00078	/src/tarantool/src/lib/tzcode/localtime.c:489

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

19

Reachable functions

61

Percentage of reachable functions covered

68.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/datetime_strptime_fuzzer.cc	1
/src/tarantool/src/lib/core/datetime.c	2
/src/tarantool/src/lib/tzcode/strptime.c	2
/src/tarantool/src/lib/core/util.c	1
/src/tarantool/src/lib/tzcode/timezone.c	5
/src/tarantool/src/lib/tzcode/localtime.c	29
/src/tarantool/third_party/c-dt/dt_core.c	3
/src/tarantool/third_party/c-dt/dt_util.c	3

Fuzzer: xrow_greeting_decode_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.66%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	6.66%
greenyellow	[30:49]	5	11.1%
lawngreen	50+	34	75.5%
All colors	45	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['abort']	2	2	mh_strnptr_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:494
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	0	None	0	0	tt_uuid_from_strl	call site: 00031	/src/tarantool/src/lib/core/tt_uuid.c:101
0	0	None	0	0	mh_strnptr_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:482
0	0	None	0	0	mh_strnptr_start_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:505
0	0	None	0	0	mh_strnptr_start_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:509
0	0	None	0	0	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:330

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

11

Reachable functions

24

Percentage of reachable functions covered

54.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_greeting_decode_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	4
/src/tarantool/src/trivia/util.h	1
/src/tarantool/src/box/xrow.c	1
/src/tarantool/src/version.h	1
/src/tarantool/src/lib/core/tt_uuid.c	1
/src/tarantool/src/lib/core/tt_uuid.h	2
/src/tarantool/src/lib/core/util.c	1
/src/tarantool/third_party/base64.c	2

Fuzzer: mp_datetime_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	100.%
All colors	6	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	0	None	0	0	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:330

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

1

Reachable functions

5

Percentage of reachable functions covered

80.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/mp_datetime_fuzzer.c	1
/src/tarantool/src/lib/core/mp_datetime.c	1
/src/tarantool/src/lib/bit/bit.h	1
/src/tarantool/src/lib/core/datetime.h	1

Fuzzer: xrow_decode_id_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	183	49.5%
gold	[1:9]	62	16.8%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	1	0.27%
lawngreen	50+	122	33.0%
All colors	369	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00207	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00303	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

156

Functions that are reachable but not covered

86

Reachable functions

189

Percentage of reachable functions covered

54.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_id_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	24
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_features.h	2
/src/tarantool/src/box/iproto_features.c	1
/src/tarantool/src/lib/bit/bit.h	1

Fuzzer: xrow_decode_dml_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	187	49.3%
gold	[1:9]	61	16.0%
yellow	[10:29]	2	0.52%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	129	34.0%
All colors	379	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00209	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	568	8 : View List ['__errno_location', 'say_log_level_is_enabled', 'diag_get', 'bit_ctz_u64', 'dump_row_hex', 'iproto_key_name', 'diag_set_error', 'BuildClientError']	8	568	xrow_decode_dml_internal	call site: 00370	/src/tarantool/src/box/xrow.c:993
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00305	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00210	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

88

Reachable functions

189

Percentage of reachable functions covered

53.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_dml_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	25
/src/tarantool/src/box/xrow.h	1
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_constants.h	2
/src/tarantool/src/lib/bit/bit.h	1

Fuzzer: datetime_parse_full_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	13.5%
gold	[1:9]	10	4.85%
yellow	[10:29]	5	2.42%
greenyellow	[30:49]	7	3.39%
lawngreen	50+	156	75.7%
All colors	206	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
25	25	1 : View List ['gmtsub']	25	25	localsub	call site: 00178	/src/tarantool/src/lib/tzcode/localtime.c:1431
2	2	1 : View List ['strlen']	2	449	datetime_parse_full	call site: 00075	/src/tarantool/src/lib/core/datetime.c:341
2	2	1 : View List ['__errno_location']	2	2	tzloadbody	call site: 00110	/src/tarantool/src/lib/tzcode/localtime.c:398
2	2	1 : View List ['update_tzname_etc']	2	2	localsub	call site: 00187	/src/tarantool/src/lib/tzcode/localtime.c:1504
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	6	1 : View List ['getnum']	0	6	getsecs	call site: 00130	/src/tarantool/src/lib/tzcode/localtime.c:866
0	0	None	26	467	tzloadbody	call site: 00099	/src/tarantool/src/lib/tzcode/localtime.c:346
0	0	None	26	467	tzloadbody	call site: 00099	/src/tarantool/src/lib/tzcode/localtime.c:352
0	0	None	4	439	tzloadbody	call site: 00120	/src/tarantool/src/lib/tzcode/localtime.c:489
0	0	None	4	439	tzloadbody	call site: 00120	/src/tarantool/src/lib/tzcode/localtime.c:493
0	0	None	4	439	tzloadbody	call site: 00123	/src/tarantool/src/lib/tzcode/localtime.c:544
0	0	None	4	439	tzloadbody	call site: 00123	/src/tarantool/src/lib/tzcode/localtime.c:556

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

19

Reachable functions

78

Percentage of reachable functions covered

75.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/datetime_parse_full_fuzzer.c	1
/src/tarantool/src/trivia/util.h	1
/src/tarantool/src/lib/core/datetime.c	3
/src/tarantool/third_party/c-dt/dt_parse_iso.c	9
/src/tarantool/third_party/c-dt/dt_core.c	7
/src/tarantool/third_party/c-dt/dt_util.c	5
/src/tarantool/src/lib/tzcode/timezone.c	6
/src/tarantool/src/lib/tzcode/localtime.c	29
/src/tarantool/src/lib/core/util.c	1

Fuzzer: xrow_decode_call_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	187	50.8%
gold	[1:9]	62	16.8%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	1	0.27%
lawngreen	50+	117	31.7%
All colors	368	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00207	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00303	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

149

Functions that are reachable but not covered

86

Reachable functions

183

Percentage of reachable functions covered

53.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_call_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	22
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_constants.h	1

Fuzzer: xrow_decode_error_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	201	29.3%
gold	[1:9]	93	13.5%
yellow	[10:29]	5	0.72%
greenyellow	[30:49]	4	0.58%
lawngreen	50+	382	55.7%
All colors	685	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
488	488	1 : View List ['fiber_delete']	488	488	cord_collect_garbage	call site: 00000	/src/tarantool/src/lib/core/fiber.c:1909
97	97	1 : View List ['ev_loop_destroy']	97	1098	cord_destroy	call site: 00000	/src/tarantool/src/lib/core/fiber.c:1941
26	26	1 : View List ['slab_put_large']	26	26	slab_put	call site: 00545	/src/tarantool/src/lib/small/small/slab_cache.c:382
23	23	3 : View List ['__errno_location', '_say_strerror', 'say_log_level_is_enabled.370']	23	23	signal_stack_free	call site: 00000	/src/tarantool/src/lib/core/fiber.c:260
20	20	1 : View List ['slab_get_large']	20	34	slab_get	call site: 00424	/src/tarantool/src/lib/small/small/slab_cache.c:321
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00232	/src/tarantool/src/lib/core/fiber.c:1223
4	4	2 : View List ['__errno_location', 'strerror_r']	4	4	munmap_checked	call site: 00447	/src/tarantool/src/lib/small/small/slab_arena.c:76
2	2	1 : View List ['mp_store_u64']	2	4	mp_encode_uint	call site: 00131	/src/tarantool/src/lib/msgpuck/msgpuck.h:2225
2	2	1 : View List ['abort']	2	2	mh_strnptr_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:494
0	262	1 : View List ['cord_on_demand']	4	266	fiber_set_name_n	call site: 00231	/src/tarantool/src/lib/core/fiber.c:1220
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	21	1 : View List ['mmap_checked']	0	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

79

Reachable functions

312

Percentage of reachable functions covered

74.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_error_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	27
/src/tarantool/src/box/xrow.c	1
/src/tarantool/src/box/error.cc	5
/src/tarantool/src/lib/core/exception.cc	6
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	9
/src/tarantool/src/lib/core/error_payload.c	8
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	15
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	7
/src/tarantool/src/lib/core/reflection.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	5
/src/tarantool/src/lib/small/small/slab_cache.c	17
/src/tarantool/src/lib/small/include/small/util.h	4
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	11
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/say.h	2
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/mp_error.cc	7
/src/tarantool/src/lib/small/small/region.c	2
/src/tarantool/src/lib/small/include/small/quota.h	2
/src/tarantool/src/lib/small/small/slab_arena.c	5
/src/tarantool/src/lib/small/include/small/lf_lifo.h	4
/src/tarantool/src/lib/core/exception.h	12
/src/tarantool/src/lib/core/ssl_error.h	2

Fuzzer: xrow_decode_sql_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	48.1%
gold	[1:9]	69	18.6%
yellow	[10:29]	2	0.54%
greenyellow	[30:49]	1	0.27%
lawngreen	50+	120	32.4%
All colors	370	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00304	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00209	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

152

Functions that are reachable but not covered

85

Reachable functions

185

Percentage of reachable functions covered

54.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_sql_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	21
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	3
/src/tarantool/src/lib/small/include/small/static.h	4
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_constants.h	1

Fuzzer: swim_proto_member_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	434	56.4%
gold	[1:9]	32	4.16%
yellow	[10:29]	16	2.08%
greenyellow	[30:49]	4	0.52%
lawngreen	50+	283	36.8%
All colors	769	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
488	488	1 : View List ['fiber_delete']	488	488	cord_collect_garbage	call site: 00696	/src/tarantool/src/lib/core/fiber.c:1909
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00318	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00432	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00452	/src/tarantool/src/lib/core/clock_lowres.c:69
23	23	3 : View List ['__errno_location', '_say_strerror', 'say_log_level_is_enabled.370']	23	23	signal_stack_free	call site: 00639	/src/tarantool/src/lib/core/fiber.c:260
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00012	/src/tarantool/src/lib/small/small/slab_arena.c:204
10	10	5 : View List ['sigdelset', 'pthread_sigmask', 'sigaddset', 'signalfd', 'sigemptyset']	10	10	ev_signal_stop	call site: 00655	/src/tarantool/third_party/libev/ev.c:4711
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00413	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00261	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00040	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00062	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00319	/src/tarantool/src/lib/core/fiber.c:1223

Runtime coverage analysis

Covered functions

155

Functions that are reachable but not covered

198

Reachable functions

334

Percentage of reachable functions covered

40.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/swim_proto_member_fuzzer.c	1
/src/tarantool/src/lib/core/memory.c	2
/src/tarantool/src/lib/small/include/small/quota.h	3
/src/tarantool/src/lib/small/small/slab_arena.c	6
/src/tarantool/src/lib/small/include/small/lf_lifo.h	4
/src/tarantool/src/lib/small/include/small/util.h	4
/src/tarantool/src/lib/core/fiber.c	41
/src/tarantool/third_party/libev/ev.c	49
/src/tarantool/third_party/libev/ev_iouring.c	17
/src/tarantool/third_party/libev/ev_epoll.c	5
/src/tarantool/third_party/libev/ev_poll.c	5
/src/tarantool/third_party/libev/ev_select.c	4
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/small/include/small/slab_cache.h	6
/src/tarantool/src/lib/small/small/slab_cache.c	11
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	7
/src/tarantool/src/lib/small/small/mempool.c	8
/src/tarantool/src/lib/salad/mhash.h	2
/src/tarantool/src/lib/core/diag.h	5
/src/tarantool/src/lib/small/include/small/region.h	3
/src/tarantool/src/lib/core/fiber.h	4
/src/tarantool/src/lib/core/clock.c	3
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	3
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	3
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/lib/core/tt_sigaction.c	2
/src/tarantool/src/lib/swim/swim_proto.c	10
/src/tarantool/src/lib/msgpuck/msgpuck.h	11
/src/tarantool/src/lib/core/exception.cc	3
/src/tarantool/src/lib/core/diag.c	6
/src/tarantool/src/lib/core/error_payload.c	1
/src/tarantool/src/lib/core/tt_uuid.h	2
/src/tarantool/src/lib/swim/swim_proto.h	1
/src/tarantool/third_party/libev/ev.h	2
/src/tarantool/src/lib/core/trigger.h	1
/src/tarantool/src/lib/small/small/region.c	1

Fuzzer: xrow_decode_begin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	176	48.7%
gold	[1:9]	67	18.5%
yellow	[10:29]	2	0.55%
greenyellow	[30:49]	1	0.27%
lawngreen	50+	115	31.8%
All colors	361	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00227	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00323	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00228	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

151

Functions that are reachable but not covered

86

Reachable functions

185

Percentage of reachable functions covered

53.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_begin_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	25
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1

Fuzzer: uri_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.38%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	44	93.6%
All colors	47	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	uri_create	call site: 00002	/src/tarantool/src/lib/uri/uri.c:257

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

12

Reachable functions

23

Percentage of reachable functions covered

47.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/uri_fuzzer.c	1
/src/tarantool/src/lib/uri/uri.c	9
/src/tarantool/build/src/lib/uri/uri_parser.rl	1
/src/tarantool/src/trivia/util.h	1

Fuzzer: xrow_decode_raft_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	225	61.1%
gold	[1:9]	61	16.5%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	81	22.0%
All colors	368	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00207	/src/tarantool/src/lib/core/fiber.c:1220
237	237	5 : View List ['mp_decode_map', 'mp_next', 'mp_decode_bool', 'mp_decode_vclock_ignore0', 'mp_decode_uint']	245	1337	xrow_decode_raft	call site: 00019	/src/tarantool/src/box/xrow.c:1421
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00303	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

96

Reachable functions

187

Percentage of reachable functions covered

48.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_raft_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	23
/src/tarantool/src/box/xrow.c	3
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/lib/vclock/vclock.h	2
/src/tarantool/src/lib/vclock/vclock.c	1

Fuzzer: luaL_loadbuffer_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	422	26.2%
gold	[1:9]	21	1.30%
yellow	[10:29]	20	1.24%
greenyellow	[30:49]	7	0.43%
lawngreen	50+	1137	70.7%
All colors	1607	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	2012	2 : View List ['luaL_gsub', 'lua_remove']	1994	2670	setpath	call site: 00000	/src/tarantool/third_party/luajit/src/lib_package.c:573
880	880	1 : View List ['lex_longstring']	880	880	lex_scan	call site: 00946	/src/tarantool/third_party/luajit/src/lj_lex.c:341
697	11482	5 : View List ['rec_idx_abc', 'lj_ffrecord_select_mode', 'lj_trace_err', 'lj_opt_fold', 'lj_ir_kint']	697	11493	rec_varg	call site: 00000	/src/tarantool/third_party/luajit/src/lj_record.c:1867
598	598	3 : View List ['lj_cdata_newx', 'snap_restoredata', 'lj_ctype_info']	678	685	snap_unsink	call site: 00000	/src/tarantool/third_party/luajit/src/lj_snap.c:832
543	543	2 : View List ['reassoc_xref', 'aa_xref']	543	985	lj_opt_fwd_xload	call site: 00000	/src/tarantool/third_party/luajit/src/lj_opt_mem.c:751
499	1014	3 : View List ['lj_err_arg', 'lj_lib_checkstr', 'strtoul']	499	1014	lj_ffh_tonumber	call site: 00000	/src/tarantool/third_party/luajit/src/lib_base.c:264
497	497	1 : View List ['lj_err_arg']	497	497	lj_lib_checkany	call site: 00000	/src/tarantool/third_party/luajit/src/lj_lib.c:187
452	452	1 : View List ['err_token']	452	452	lj_parse	call site: 00980	/src/tarantool/third_party/luajit/src/lj_parse.c:2756
452	452	1 : View List ['err_token']	452	452	lex_str	call site: 01069	/src/tarantool/third_party/luajit/src/lj_parse.c:1041
452	452	1 : View List ['err_token']	452	452	lex_check	call site: 01003	/src/tarantool/third_party/luajit/src/lj_parse.c:1018
445	445	1 : View List ['lj_err_callerv']	445	445	luaL_pushmodule	call site: 00000	/src/tarantool/third_party/luajit/src/lib_aux.c:121
445	445	1 : View List ['lj_err_caller']	445	445	lua_setmetatable	call site: 00000	/src/tarantool/third_party/luajit/src/lj_api.c:1068

Runtime coverage analysis

Covered functions

3416

Functions that are reachable but not covered

100

Reachable functions

532

Percentage of reachable functions covered

81.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/luaL_loadbuffer/luaL_loadbuffer_fuzzer.cc	4
/src/tarantool/third_party/luajit/src/lib_aux.c	5
/src/tarantool/third_party/luajit/src/lj_state.c	10
/src/tarantool/third_party/luajit/src/lj_dispatch.c	3
/src/tarantool/third_party/luajit/src/lj_gc.c	32
/src/tarantool/third_party/luajit/src/lj_assert.c	1
/src/tarantool/third_party/luajit/src/lj_err.c	14
/src/tarantool/third_party/luajit/src/lj_str.c	3
/src/tarantool/third_party/luajit/src/lj_strfmt.c	9
/src/tarantool/third_party/luajit/src/lj_buf.c	6
/src/tarantool/third_party/luajit/src/lj_strfmt_num.c	9
/src/tarantool/third_party/luajit/src/lj_api.c	24
/src/tarantool/third_party/luajit/src/lj_debug.c	8
/src/tarantool/third_party/luajit/src/lj_tab.c	19
/src/tarantool/third_party/luajit/src/lj_meta.c	6
/src/tarantool/third_party/luajit/src/lj_lex.c	14
/src/tarantool/third_party/luajit/src/lj_trace.c	5
/src/tarantool/third_party/luajit/src/lj_func.c	7
/src/tarantool/third_party/luajit/src/lj_mcode.c	2
/src/tarantool/third_party/luajit/src/lj_ctype.c	4
/src/tarantool/third_party/luajit/src/lj_ccallback.c	1
/src/tarantool/third_party/luajit/src/lj_obj.c	1
/src/tarantool/third_party/luajit/src/lj_vmevent.c	1
/src/tarantool/test/fuzz/luaL_loadbuffer/serializer.cc	59
/src/tarantool/third_party/luajit/src/lib_init.c	1
/src/tarantool/third_party/luajit/src/lj_load.c	5
/src/tarantool/third_party/luajit/src/lj_bcread.c	15
/src/tarantool/third_party/luajit/src/lib_ffi.c	3
/src/tarantool/third_party/luajit/src/lj_lib.c	3
/src/tarantool/third_party/luajit/src/lj_memprof.c	2
/src/tarantool/third_party/luajit/src/lj_wbuf.c	9
/src/tarantool/third_party/luajit/src/lj_symtab.c	1
/src/tarantool/third_party/luajit/src/lj_utils_leb128.c	1
/src/tarantool/third_party/luajit/src/lj_sysprof.c	4
/src/tarantool/third_party/luajit/src/lj_clib.c	2
/src/tarantool/third_party/luajit/src/lj_udata.c	1
/src/tarantool/third_party/luajit/src/lj_parse.c	112
/src/tarantool/third_party/luajit/src/lj_strscan.c	6
/src/tarantool/third_party/luajit/src/lj_vmmath.c	1
/src/tarantool/third_party/luajit/src/lj_mapi.c	1
/src/tarantool/third_party/luajit/src/lj_profile_timer.c	1
/src/tarantool/third_party/luajit/src/lj_profile.c	1

Fuzzer: xrow_header_decode_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	47.1%
gold	[1:9]	69	18.8%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	124	33.7%
All colors	367	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
488	488	1 : View List ['fiber_delete']	488	488	cord_collect_garbage	call site: 00000	/src/tarantool/src/lib/core/fiber.c:1909
97	97	1 : View List ['ev_loop_destroy']	97	1098	cord_destroy	call site: 00000	/src/tarantool/src/lib/core/fiber.c:1941
23	23	3 : View List ['__errno_location', '_say_strerror', 'say_log_level_is_enabled.370']	23	23	signal_stack_free	call site: 00000	/src/tarantool/src/lib/core/fiber.c:260
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
4	564	6 : View List ['__errno_location', 'diag_set_error', 'say_log_level_is_enabled', 'dump_row_hex', 'diag_get', 'BuildClientError']	4	564	xrow_header_decode	call site: 00067	/src/tarantool/src/box/xrow.c:238
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00237	/src/tarantool/src/lib/core/fiber.c:1223
2	2	1 : View List ['abort']	2	2	mh_strnptr_resize	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:494
0	262	1 : View List ['cord_on_demand']	4	266	fiber_set_name_n	call site: 00236	/src/tarantool/src/lib/core/fiber.c:1220
0	56	1 : View List ['mh_strnptr_put']	0	56	mh_strnptr_put	call site: 00000	/src/tarantool/src/lib/salad/mhash.h:319
0	5	3 : View List ['error_payload_destroy', 'error_msg_is_malloced', 'free']	0	5	error_unref	call site: 00353	/src/tarantool/src/lib/core/diag.c:67
0	0	None	15	19	dump_row_hex	call site: 00361	/src/tarantool/src/box/xrow.c:125
0	0	None	6	6	madvise_checked	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:50

Runtime coverage analysis

Covered functions

136

Functions that are reachable but not covered

81

Reachable functions

184

Percentage of reachable functions covered

55.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_header_decode_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	24
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1

Fuzzer: xrow_decode_watch_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	49.3%
gold	[1:9]	61	16.5%
yellow	[10:29]	2	0.54%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	124	33.6%
All colors	369	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00207	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00303	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

151

Functions that are reachable but not covered

86

Reachable functions

185

Percentage of reachable functions covered

53.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_watch_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	24
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_constants.h	1

Fuzzer: xrow_decode_auth_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	180	49.0%
gold	[1:9]	61	16.6%
yellow	[10:29]	9	2.45%
greenyellow	[30:49]	1	0.27%
lawngreen	50+	116	31.6%
All colors	367	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
262	262	1 : View List ['cord_on_demand']	266	266	fiber_set_name_n	call site: 00207	/src/tarantool/src/lib/core/fiber.c:1220
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1719']	23	23	clock_monotonic	call site: 00000	/src/tarantool/src/lib/core/clock.c:51
23	23	4 : View List ['tt_strerror', '__errno_location', 'exit', 'say_log_level_is_enabled.1439']	23	23	clock_lowres_signal_init	call site: 00000	/src/tarantool/src/lib/core/clock_lowres.c:69
21	21	1 : View List ['mmap_checked']	21	34	slab_arena_create	call site: 00000	/src/tarantool/src/lib/small/small/slab_arena.c:204
8	8	1 : View List ['tt_pthread_setname']	8	8	cord_set_name	call site: 00303	/src/tarantool/src/lib/core/fiber.c:2232
6	6	3 : View List ['sigaddset', 'pthread_sigmask', 'sigemptyset']	6	6	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4680
4	4	2 : View List ['atoi', 'getenv']	386	572	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3302
4	4	2 : View List ['close', 'dup2']	4	8	evpipe_alloc	call site: 00000	/src/tarantool/third_party/libev/ev.c:2764
4	4	4 : View List ['malloc', 'exit', 'realloc', 'say_log_level_is_enabled.370']	4	4	fiber_set_name_n	call site: 00208	/src/tarantool/src/lib/core/fiber.c:1223
2	39	4 : View List ['ev_unref', 'ev_io_start', '__errno_location', 'fd_intern']	24	134	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4629
2	2	1 : View List ['getpid']	401	587	loop_init	call site: 00000	/src/tarantool/third_party/libev/ev.c:3298
2	2	1 : View List ['signalfd']	16	89	ev_signal_start	call site: 00000	/src/tarantool/third_party/libev/ev.c:4648

Runtime coverage analysis

Covered functions

149

Functions that are reachable but not covered

86

Reachable functions

183

Percentage of reachable functions covered

53.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/xrow_decode_auth_fuzzer.c	1
/src/tarantool/src/lib/msgpuck/msgpuck.h	22
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/lib/core/say.h	1
/src/tarantool/src/box/error.cc	4
/src/tarantool/src/lib/core/exception.cc	5
/src/tarantool/src/trivia/util.h	2
/src/tarantool/src/lib/core/diag.c	7
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	1
/src/tarantool/src/lib/core/diag.h	8
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	3
/src/tarantool/src/box/error.h	1
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/lib/core/fiber.c	24
/src/tarantool/src/lib/small/include/small/slab_cache.h	3
/src/tarantool/src/lib/small/small/slab_cache.c	1
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	3
/src/tarantool/src/lib/small/small/mempool.c	2
/src/tarantool/src/lib/salad/mhash.h	1
/src/tarantool/src/lib/small/include/small/region.h	2
/src/tarantool/src/lib/core/fiber.h	1
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	1
/src/tarantool/src/lib/small/include/small/static.h	3
/src/tarantool/src/lib/core/clock_lowres.h	1
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	1
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/iproto_constants.h	1

Fuzzer: sql_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7927	77.7%
gold	[1:9]	173	1.69%
yellow	[10:29]	101	0.99%
greenyellow	[30:49]	30	0.29%
lawngreen	50+	1958	19.2%
All colors	10189	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
41855	41876	6 : View List ['space_by_id_fast.10890', 'sqlExprIsVector', 'sqlExprCanBeNull', 'sqlExprCacheRemove', 'codeExprOrVector', 'codeAllEqualityTerms']	41883	86303	sqlWhereCodeOneLoopStart	call site: 05261	/src/tarantool/src/box/sql/wherecode.c:730
27913	167571	10 : View List ['sqlExprIsConstantOrFunction', 'sqlResolveExprNames', 'sqlResolveSelectNames', 'resolveCompoundOrderBy', 'sql_select_op_name', 'sql_expr_new', 'sql_expr_delete', 'tt_sprintf.7911', 'resolveOrderGroupBy', 'sqlResolveExprListNames']	27929	169595	resolveSelectStep	call site: 02313	/src/tarantool/src/box/sql/resolve.c:1270
15117	26163	32 : View List ['sqlIndexedByLookup', 'sqlSelectSetName', 'diag_set_error.8346', 'sqlWalkSelect', 'sqlExprListSetName', 'sqlTokenInit', 'sql_expr_list_delete', 'strlen', '__errno_location', 'sqlMPrintf', 'sql_template_space_new', 'sqlColumnsFromExprList', 'diag_get', 'sqlMatchSpanName', 'say_log_level_is_enabled.8342', 'sql_xstrdup', 'sql_expr_new_named.8514', 'sql_expr_list_append', 'BuildClientError', 'sql_view_compile', 'sqlProcessJoin', 'sqlSrcListAssignCursors', 'tableAndColumnIndex', 'expr_autoname_is_required', 'sqlIdListIndex', 'sql_xfree', 'tt_sprintf.8260', 'withExpand', 'sql_generate_column_name', 'sql_lookup_space', 'strcmp', 'sqlPExpr']	15117	26163	selectExpander	call site: 02443	/src/tarantool/src/box/sql/select.c:4916
13980	13980	1 : View List ['multiSelect']	16402	16442	sqlSelect	call site: 03141	/src/tarantool/src/box/sql/select.c:5633
13960	13960	1 : View List ['codeVectorCompare']	13960	13970	sqlExprCodeTarget	call site: 02615	/src/tarantool/src/box/sql/expr.c:3796
11252	11754	12 : View List ['sqlVdbeSetChanges', '__errno_location', 'diag_set_error.10124', 'sqlCloseSavepoints', 'sqlVdbeCloseStatement', 'sqlRollbackAll', 'diag_get', 'box_txn_rollback', 'txn_commit', 'say_log_level_is_enabled.10120', 'in_txn.10125', 'BuildClientError']	11252	23025	sqlVdbeHalt	call site: 09315	/src/tarantool/src/box/sql/vdbeaux.c:1788
4067	4138	2 : View List ['key_def_merge', 'index_def_delete']	4067	4161	index_def_new	call site: 04915	/src/tarantool/src/box/index_def.c:119
3514	3812	9 : View List ['sqlVdbeAddOp1', 'sqlVdbeChangeP5', 'sql_set_multi_write', 'sqlGetVdbe', 'sqlVdbeAddOp2', 'sqlVdbeAddOp3', 'vdbe_emit_new_sec_index_id', 'sqlVdbeAddOp0', 'vdbe_emit_create_index']	3514	4154	sql_create_index	call site: 06129	/src/tarantool/src/box/sql/build.c:2920
3464	3464	2 : View List ['sqlTreeViewSelect', 'sqlDebugPrintf']	3464	3464	flattenSubquery	call site: 03138	/src/tarantool/src/box/sql/select.c:4332
2860	3505	9 : View List ['__errno_location', 'diag_get', 'diag_set_error.5459', 'sqlGetVdbe', 'sql_space_by_src', 'sqlVdbeAddOp2', 'vdbe_emit_ck_constraint_create', 'say_log_level_is_enabled.5456', 'BuildClientError']	2860	3505	sql_create_check_contraint	call site: 07386	/src/tarantool/src/box/sql/build.c:831
2340	2340	2 : View List ['whereLoopPrint', 'sqlDebugPrintf']	2340	2340	whereLoopInsert	call site: 04985	/src/tarantool/src/box/sql/where.c:1488
2266	2266	2 : View List ['whereLoopCheaperProperSubset', 'sqlDebugPrintf']	2266	2266	whereLoopAdjustCost	call site: 04980	/src/tarantool/src/box/sql/where.c:1313

Runtime coverage analysis

Covered functions

3813

Functions that are reachable but not covered

2251

Reachable functions

3234

Percentage of reachable functions covered

30.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/tarantool/test/fuzz/sql_fuzzer/sql_fuzzer.cc	2
/src/tarantool/test/fuzz/sql_fuzzer/sql_query_proto_to_string.cc	68
/src/tarantool/src/box/sql.c	34
/src/tarantool/src/box/sql/prepare.c	3
/src/tarantool/src/box/session.h	6
/src/tarantool/src/lib/core/cord_on_demand.cc	3
/src/tarantool/src/trivia/util.h	3
/src/tarantool/src/lib/core/fiber.c	61
/src/tarantool/src/lib/small/include/small/slab_cache.h	8
/src/tarantool/src/lib/small/small/slab_cache.c	17
/src/tarantool/src/lib/small/include/small/util.h	3
/src/tarantool/src/lib/small/include/small/slab_list.h	2
/src/tarantool/src/lib/small/include/small/mempool.h	9
/src/tarantool/src/lib/small/small/mempool.c	10
/src/tarantool/src/lib/salad/mhash.h	33
/src/tarantool/src/lib/core/diag.h	17
/src/tarantool/src/lib/small/include/small/region.h	16
/src/tarantool/src/lib/core/fiber.h	4
/src/tarantool/src/lib/core/say.h	2
/src/tarantool/src/lib/core/clock.c	2
/src/tarantool/src/lib/core/tt_strerror.c	1
/src/tarantool/src/lib/core/tt_static.h	5
/src/tarantool/src/lib/small/include/small/static.h	4
/src/tarantool/src/lib/core/clock_lowres.h	2
/src/tarantool/src/lib/core/clock_lowres.c	1
/src/tarantool/src/tt_pthread.h	1
/src/tarantool/src/lib/core/trigger.cc	8
/src/tarantool/src/lib/core/say.c	1
/src/tarantool/src/box/session.c	6
/src/tarantool/src/lib/small/small/slab_arena.c	5
/src/tarantool/src/lib/small/include/small/lf_lifo.h	4
/src/tarantool/src/lib/small/include/small/quota.h	2
/src/tarantool/src/box/user.cc	5
/src/tarantool/src/lib/core/trigger.h	3
/src/tarantool/src/box/lua/session.c	1
/src/tarantool/third_party/luajit/src/lj_api.c	25
/src/tarantool/third_party/luajit/src/lj_assert.c	1
/src/tarantool/third_party/luajit/src/lj_str.c	3
/src/tarantool/third_party/luajit/src/lj_err.c	16
/src/tarantool/third_party/luajit/src/lj_strfmt.c	9
/src/tarantool/third_party/luajit/src/lj_buf.c	6
/src/tarantool/third_party/luajit/src/lj_gc.c	28
/src/tarantool/third_party/luajit/src/lj_strfmt_num.c	9
/src/tarantool/third_party/luajit/src/lj_state.c	4
/src/tarantool/third_party/luajit/src/lj_debug.c	9
/src/tarantool/third_party/luajit/src/lj_meta.c	5
/src/tarantool/third_party/luajit/src/lj_tab.c	21
/src/tarantool/third_party/luajit/src/lj_obj.c	1
/src/tarantool/third_party/luajit/src/lib_aux.c	2
/src/tarantool/third_party/luajit/src/lj_strscan.c	7
/src/tarantool/src/box/sql_stmt_cache.c	4
/src/tarantool/src/box/sql/vdbeapi.c	4
/src/tarantool/src/lib/core/assoc.h	2
/src/tarantool/third_party/PMurHash.c	2
/src/tarantool/src/box/user.h	1
/src/tarantool/src/box/error.cc	6
/src/tarantool/src/lib/core/exception.cc	10
/src/tarantool/src/lib/core/diag.c	9
/src/tarantool/src/lib/core/error_payload.c	7
/src/tarantool/src/rmean.c	1
/src/tarantool/src/box/errcode.h	2
/src/tarantool/src/lib/msgpuck/msgpuck.h	62
/src/tarantool/src/lib/salad/grp_alloc.h	8
/src/tarantool/src/box/tuple.h	28
/src/tarantool/src/box/error.h	1
/src/tarantool/src/box/sql/malloc.c	6
/src/tarantool/src/box/sql/tokenize.c	8
/src/tarantool/build/src/box/sql/parse.c	13
/src/tarantool/build/src/box/sql/keywordhash.h	1
/src/tarantool/src/box/sql/expr.c	128
/src/tarantool/src/box/sql/select.c	75
/src/tarantool/src/box/sql/build.c	85
/src/tarantool/src/box/sql/trigger.c	22
/src/tarantool/src/box/sql/parse_def.c	7
/src/tarantool/src/box/sql/parse_def.h	19
/src/tarantool/src/box/sql/vdbeaux.c	62
/src/tarantool/src/lib/salad/stailq.h	6
/src/tarantool/src/box/schema.cc	1
/src/tarantool/src/box/sql/sqlInt.h	9
/src/tarantool/src/box/sql/util.c	20
/src/tarantool/src/box/identifier.c	1
/src/tarantool/src/lib/small/small/region.c	4
/src/tarantool/src/lib/core/util.c	4
/src/tarantool/src/box/sql/parse.y	9
/src/tarantool/src/box/key_def.c	14
/src/tarantool/src/lib/coll/coll.c	2
/src/tarantool/src/box/sql/mem.c	11
/src/tarantool/src/lib/mpstream/mpstream.c	9
/src/tarantool/src/box/sql/vdbeInt.h	1
/src/tarantool/src/lib/mpstream/mpstream.h	4
/src/tarantool/src/box/field_def.h	3
/src/tarantool/src/box/space_cache.h	5
/src/tarantool/src/box/space_cache.c	2
/src/tarantool/src/lib/core/decimal.c	19
/src/tarantool/third_party/decNumber/decNumber.c	34
/src/tarantool/third_party/decNumber/decContext.c	3
/src/tarantool/src/lib/core/mp_decimal.c	3
/src/tarantool/third_party/decNumber/decPacked.c	2
/src/tarantool/src/box/sql/walker.c	6
/src/tarantool/src/box/sql/printf.c	21
/src/tarantool/src/box/sql/mem.h	4
/src/tarantool/src/lib/msgpuck/msgpuck.c	3
/src/tarantool/src/lib/core/tt_uuid.c	1
/src/tarantool/src/lib/core/tt_uuid.h	1
/src/tarantool/src/lib/core/datetime.c	3
/src/tarantool/third_party/c-dt/dt_core.c	3
/src/tarantool/src/lib/tzcode/timezone.c	1
/src/tarantool/src/box/space.h	13
/src/tarantool/src/box/space.c	5
/src/tarantool/src/box/schema_def.h	1
/src/tarantool/src/box/index_def.h	2
/src/tarantool/src/box/sql/resolve.c	20
/src/tarantool/src/box/column_mask.h	2
/src/tarantool/src/box/sql/func.c	10
/src/tarantool/src/box/func_cache.c	1
/src/tarantool/src/box/sql/hash.c	9
/src/tarantool/src/box/sql/delete.c	5
/src/tarantool/src/box/sql/treeview.c	9
/src/tarantool/src/box/field_def.c	1
/src/tarantool/src/box/tuple_format.h	7
/src/tarantool/src/box/coll_id_cache.c	2
/src/tarantool/src/lib/json/json.h	5
/src/tarantool/src/lib/json/json.c	15
/src/tarantool/src/box/sql/where.c	55
/src/tarantool/src/box/sql/whereexpr.c	23
/src/tarantool/src/box/index_def.c	3
/src/tarantool/src/box/key_def.h	11
/src/tarantool/src/lib/coll/coll.h	1
/src/tarantool/src/box/tuple_compare.cc	93
/usr/local/bin/../include/c++/v1/math.h	5
/src/tarantool/src/lib/core/mp_datetime.c	2
/src/tarantool/src/lib/bit/bit.h	8
/src/tarantool/src/lib/core/datetime.h	1
/src/tarantool/src/box/field_map.h	1
/src/tarantool/src/box/tuple.c	13
/src/tarantool/src/box/tuple_compare.h	1
/src/tarantool/src/box/tuple_hash.cc	8
/src/tarantool/src/box/tuple_extract_key.cc	22
/src/tarantool/src/box/index.h	6
/src/tarantool/src/box/sql/wherecode.c	9
/src/tarantool/src/box/sql/cursor.c	2
/src/tarantool/src/box/iterator_type.h	2
/src/tarantool/src/box/index.cc	16
/src/tarantool/src/box/index_weak_ref.h	5
/src/tarantool/src/box/index_weak_ref.c	1
/src/tarantool/src/cfg.c	4
/src/tarantool/third_party/luajit/src/lj_load.c	5
/src/tarantool/third_party/luajit/src/lj_lex.c	13
/src/tarantool/third_party/luajit/src/lj_bcread.c	15
/src/tarantool/third_party/luajit/src/lib_ffi.c	3
/src/tarantool/third_party/luajit/src/lj_ctype.c	3
/src/tarantool/third_party/luajit/src/lj_lib.c	3
/src/tarantool/third_party/luajit/src/lj_dispatch.c	2
/src/tarantool/third_party/luajit/src/lj_vmevent.c	1
/src/tarantool/third_party/luajit/src/lj_func.c	4
/src/tarantool/third_party/luajit/src/lj_memprof.c	1
/src/tarantool/third_party/luajit/src/lj_wbuf.c	6
/src/tarantool/third_party/luajit/src/lj_symtab.c	1
/src/tarantool/third_party/luajit/src/lj_utils_leb128.c	1
/src/tarantool/third_party/luajit/src/lj_sysprof.c	1
/src/tarantool/third_party/luajit/src/lj_clib.c	2
/src/tarantool/third_party/luajit/src/lj_udata.c	1
/src/tarantool/third_party/luajit/src/lj_parse.c	112
/src/tarantool/third_party/luajit/src/lj_vmmath.c	1
/src/tarantool/src/lua/utils.c	6
/src/tarantool/src/box/sql/update.c	1
/src/tarantool/src/box/sql/insert.c	9
/src/tarantool/src/box/sql/pragma.c	9
/src/tarantool/src/lib/small/small/small.c	9
/src/tarantool/src/lib/small/include/small/small_class.h	2
/src/tarantool/src/box/schema.h	1
/src/tarantool/src/box/user_def.c	1
/src/tarantool/src/box/schema_def.c	1
/src/tarantool/src/scoped_guard.h	3
/src/tarantool/src/box/box.cc	3
/src/tarantool/third_party/base64.c	3
/src/tarantool/src/box/txn.h	17
/src/tarantool/src/box/txn.c	25
/src/tarantool/src/box/engine.h	5
/src/tarantool/src/box/box.h	1
/src/tarantool/src/box/sql/alter.c	1
/src/tarantool/third_party/libev/ev.c	16
/src/tarantool/src/box/txn_event_trigger.c	11
/src/tarantool/src/lib/core/event.h	3
/src/tarantool/src/lib/core/event.c	7
/src/tarantool/src/box/port.c	6
/src/tarantool/src/lib/core/func_adapter.h	2
/src/tarantool/src/lib/core/port.c	1
/src/tarantool/src/box/memtx_tx.c	20
/src/tarantool/src/box/journal.c	6
/src/tarantool/src/box/journal.h	5
/src/tarantool/src/box/txn_limbo.c	17
/src/tarantool/src/box/txn_limbo.h	4
/src/tarantool/src/lib/core/ratelimit.h	1
/src/tarantool/src/lib/vclock/vclock.h	4
/src/tarantool/src/box/xrow.h	1
/src/tarantool/src/box/watcher.c	18
/src/tarantool/third_party/coro/coro.c	1
/src/tarantool/src/lib/vclock/vclock.c	1
/src/tarantool/src/box/xrow.c	2
/src/tarantool/src/box/iproto_constants.h	2
/src/tarantool/src/lib/core/fiber_cond.c	1
/src/tarantool/src/box/sql/main.c	2