coverage 2.8 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283
  1. #!/bin/sh
  2. # Copyright 2017 Google Inc.
  3. #
  4. # Use of this source code is governed by a BSD-style license that can be
  5. # found in the LICENSE file.
  6. if [ -z "$1" ]; then
  7. cat <<-EOM
  8. Usage:
  9. $0 [afl-out-loc]
  10. Run something like this:
  11. $0 ~/afl-out
  12. where afl-out is the directory containing all the output of the afl-fuzzers.
  13. You can typically ssh into skia-fuzzer-be-1 and skia-fuzzer-be-2 and run
  14. tar -czf afl-out.tar.gz /mnt/ssd0/fuzzes/afl-out/*/fuzzer0/queue
  15. and extract it locally to get the directories needed to assess coverage.
  16. EOM
  17. exit 1
  18. fi
  19. set -x
  20. set -e
  21. cd "$(dirname "$0")/.."
  22. EXECUTABLE="fuzz"
  23. DIR="$(mktemp -d "${TMPDIR:-/tmp}/skia_coverage_XXXXXXXXXX")"
  24. BUILD=out/coverage
  25. # Build $EXECUTABLE
  26. bin/sync
  27. bin/fetch-gn
  28. rm -rf $BUILD
  29. #TODO: make this work with Clang.
  30. ARGS='cc="gcc" cxx="g++" extra_cflags=["--coverage"] extra_ldflags=["--coverage"]'
  31. gn gen --args="$ARGS" "$BUILD"
  32. ninja -C "$BUILD" "$EXECUTABLE"
  33. GCOV="$(realpath tools/gcov_shim)"
  34. # Generate a zero-baseline so files not covered by $EXECUTABLE $@ will
  35. # still show up in the report. This reads the .gcno files that are
  36. # created at compile time.
  37. lcov -q --gcov-tool="$GCOV" -c -b "$BUILD" -d "$BUILD" -o "$DIR"/baseline -i
  38. # Running the binary generates the real coverage information, the .gcda files.
  39. QUEUES=("$1/api_parse_path/fuzzer0/queue/*" "$1/color_deserialize/fuzzer0/queue/*" "$1/skcodec_scale/fuzzer0/queue/*" "$1/skcodec_mode/fuzzer0/queue/*" "$1/api_draw_functions/fuzzer0/queue/*" "$1/api_gradient/fuzzer0/queue/*" "$1/api_image_filter/fuzzer0/queue/*" "$1/api_pathop/fuzzer0/queue/*" "$1/sksl2glsl/fuzzer0/queue/*" "$1/null_canvas/fuzzer0/queue/*" "$1/pdf_canvas/fuzzer0/queue/*" "$1/n32_canvas/fuzzer0/queue/*")
  40. ARGS=("-n ParsePath" "-t color_deserialize" "-t image_scale" "-t image_mode" "-n DrawFunctions" "-n Gradients" "-n SerializedImageFilter" "-n Pathop" "-t sksl2glsl" "-n NullCanvas" "-n PDFCanvas" "-n RasterN32Canvas")
  41. # We can't simply pass the directories to the fuzzers because some of the fuzzes will
  42. # crash or assert, which would kill the call to fuzz prematurely. Instead we run them
  43. # individually using the loops below.
  44. for i in `seq ${#QUEUES[@]}`
  45. do
  46. FILES=${QUEUES[i]}
  47. for f in $FILES
  48. do
  49. # Executing the fuzzes sequentially would take a very long time. So, we run them
  50. # in the background, making sure we don't go crazy and execute them too fast or
  51. # that they execute for a long time.
  52. timeout 10 $BUILD/$EXECUTABLE ${ARGS[i]} -b $f &
  53. sleep .005s
  54. done
  55. done
  56. sleep 10s
  57. echo "done running the fuzzes -- generating report"
  58. lcov -q --gcov-tool="$GCOV" -c -b "$BUILD" -d "$BUILD" -o "$DIR"/coverage
  59. lcov -q -a "$DIR"/baseline -a "$DIR"/coverage -o "$DIR"/merged
  60. genhtml -q "$DIR"/merged --legend -o "$DIR"/coverage_report --ignore-errors source
  61. xdg-open "$DIR"/coverage_report/index.html