qcms doesn't have much as much coverage as it should.

[jrmuizel]

If you look at the new Rust coverage reports for qcms, the coverage is really limited with the initial lines of the fuzz harness only being executed 4 times:
https://storage.googleapis.com/oss-fuzz-coverage/qcms/reports/20210312/linux/src/mozilla-central/gfx/qcms/fuzz/fuzz_targets/fuzz_target_qcms.rs.html

Given the size of the corpus this doesn't seem correct. Further, there are open crashes for areas of the code not covered by the coverage report.

[inferno-chromium]

@catenacyber - does your recent fix fix this ?

[catenacyber]

@jrmuizel thanks for this report.
I do not have access to the current corpus to test.
But I hope #5385 should fix this. (my guess is that the 4th input from your corpus stops the run)

As rustc optimizations are disabled to build the fuzz targets for coverage cf rust-lang/rust#82144
this turns on https://doc.rust-lang.org/rustc/codegen-options/index.html#debug-assertions

Could you try locally with the corpus downloaded to path/to/corpus/ and using #5385 ?

python3 infra/helper.py build_image --no-pull base-builder
python3 infra/helper.py build_fuzzers --sanitizer=coverage qcms
python3 infra/helper.py coverage --fuzz-target fuzz --corpus-dir path/to/corpus/ qcms

You can also check the log from the fuzz target running on the coverage in the file build/out/qcms/logs/fuzz.log

[jrmuizel]

Yeah, it's believable that debug_asserts! would be causing this. qcms triggers debug_asserts! in weird scenarios so they're not usable for fuzzing.

[catenacyber]

Let me know if it improves in the next few days

[jrmuizel]

I think qcms coverage runs may also fail because of overflow checks that trigger that wouldn't trigger in release builds.

[catenacyber]

Buffer overflow or integer overflow ?
Integer overflows are parts of debug_asserts I think.

[jrmuizel]

Interger overlow. But you're right, those checks are disabled by RUSTFLAGS="-C debug-assertions=no"

[jrmuizel]

The latest coverage report looks a lot better:
https://storage.googleapis.com/oss-fuzz-coverage/qcms/reports/20210315/linux/src/mozilla-central/gfx/report.html