Module showmap

Expand description

AFL-afl-showmap-style corpus replay.

Replays a persisted corpus through a fresh executor and emits one text file per trial (or per corpus entry). Each line has the form <id>:<count>:

EVM IDs use the deterministic (bytecode_hash, pc) derived from the line-coverage HitMap so that IDs are stable across forge invocations and meaningful for cross-approach analysis. Format: evm_<bytecode_hash[:16]>_<pc:04x>.
Sancov IDs use the deterministic guard index from the sancov bitmap: sancov_0x<index:04x>.

Counts are raw saturating-summed hitcounts across the replayed corpus.

Output is consumable by tools like riesentoaster/differential-coverage.

Structs§

InvariantReplayOptions: Invariant replay settings that affect when terminal checks run.
MinimizationReplayInput
ReplayObservation: Facts observed while replaying one candidate for corpus minimization.
ShowmapOpts: Per-replay options.
ShowmapReplayTarget: Test target metadata needed to replay corpus entries.
ShowmapStats: Stats returned from a single trial replay.

ReplayFailure: A structured identity for a failure observed during corpus replay.
ShowmapDomain: Which coverage bitmap(s) to dump.

accumulate_evm 🔒: Saturating-add per-(bytecode, pc) hits from a HitMaps snapshot into dst.
accumulate_sancov 🔒: Saturating-add src (u8 raw counts) into dst (u64 aggregated counts).
broken_after_invariant 🔒
broken_invariant 🔒
fuzz_replay_call_succeeded 🔒
invariant_handler_failure 🔒: Returns a ReplayFailure::Handler if a handler call should be treated as a bug, mirroring the campaign: assertion failures always count, plain reverts only count under fail_on_revert and are never counted for vm.assume rejects.
record_replay_failure 🔒: Records failure as the representative failure for an observation, preferring terminal failures over non-terminal handler bugs and keeping the first of each class.
replay_corpus_to_showmap: Replay every corpus entry under corpus_dir and emit showmap files.
replay_failure_report 🔒
replay_sequence_for_minimization: Replays one candidate input and returns coverage/failure facts for minimizers.
should_check_invariant 🔒: Whether the invariant predicate should be evaluated after the accepted-th committed (non-vm.assume) call.
write_evm 🔒: Each EVM ID is evm_<bytecode_hash[:16hex]>_<pc:04x>. The 16-hex prefix (64 bits) of the keccak256 bytecode hash makes IDs deterministic across processes while keeping line lengths short.
write_sancov 🔒
write_showmap_file 🔒: Write a single showmap file. Returns 1 if a file was written, 0 if skipped (no nonzero entries).