unreachable code paths need to be excluded from having coverage instrumentation #20992
Labels
backend-llvm
The LLVM backend outputs an LLVM IR Module.
enhancement
Solving this issue will likely involve adding new logic or components to the codebase.
fuzzing
Milestone
Looking at the "if tower" example:
We see edges for every safety check:
We can access the raw pointer of the slices to escape the safety check, demonstrating that those edges disappear:
Those safety check edges are not interesting for code coverage because they are unreachable. The fuzzer still wants to know about any comparisons used which may have led to those unreachable branches, but we are not expecting to have code coverage for unreachable paths!
Fortunately, LLVM has a
!nosanitize
metadata node. Here is an example of using it on a branch:So, the cmp should still have the instrumentation because it provides the cmp operands to the fuzzer, and the fuzzer is trying to find inputs that cause the unreachable path to be reached, but there should not be a PC edge annotation on the branch, because we'll know it got hit when the process panics and crashes!
The text was updated successfully, but these errors were encountered: