I’m fuzzing a simple tokenizer using zig build test --fuzz
, and I opened the web interface, but I feel like I need some help to interpret what I’m seeing, as I don’t know very much about fuzzing. Here’s a snapshot of the statistics:
* Total Runs: 1291225
* Unique Runs: 1288803 (99.8%)
* Speed (Runs/Second): 57899
* Coverage: 119 / 6871 (1.7%)
“Total Runs” and “Speed” are obvious, the other two I’m not so sure about.
- What exactly makes a run “unique”?
- What do the numbers represent in “Coverage”? I’m guessing it’s ‘current / total’, but the total of what exactly?
- Why does the coverage very quickly arrive at 119, and then not make any more progress?
- I understand the the dots in the source view represent branches that the fuzzer has hit, but how do the red and green dots differ?