Add support for generating coverage

.github/workflows/ci.yml

@@ -96,7 +96,7 @@ jobs:
 
       - uses: taiki-e/install-action@v2
         with:
-          tool: cargo-udeps
+          tool: cargo-llvm-cov, cargo-udeps
 
       # smoelius: I expect this list to grow.
       - name: Install tools

.gitignore

@@ -1 +1,3 @@
 /target
+/test-fuzz/coverage
+/test-fuzz/lcov.info

Cargo.toml

@@ -48,6 +48,7 @@ serde_assert = "0.8"
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive", "rc"] }
 sha1 = "0.10"
+snapbox = "0.6"
 similar-asserts = "1.7"
 strip-ansi-escapes = "0.2"
 strum_macros = "0.27"

README.md

@@ -283,6 +283,13 @@ Options:
       --backtrace                 Display backtraces
       --consolidate               Move one target's crashes, hangs, and work queue to its corpus; to
                                   consolidate all targets, use --consolidate-all
+      --coverage <COVERAGE>       Generate coverage for corpus, crashes, hangs, or work queue. By
+                                  default, an uninstrumented fuzz target is used. To generate
+                                  coverage with instrumentation, append `-instrumented` to <OBJECT>,
+                                  e.g., --coverage corpus-instrumented. [possible values: corpus,
+                                  corpus-instrumented, crashes, crashes-instrumented, generic-args,
+                                  hangs, hangs-instrumented, impl-generic-args, queue,
+                                  queue-instrumented]
       --cpus <N>                  Fuzz using at most <N> cpus; default is all but one
       --display <OBJECT>          Display corpus, crashes, generic args, `impl` generic args, hangs,
                                   or work queue. By default, an uninstrumented fuzz target is used.
@@ -301,7 +308,8 @@ Options:
       --no-ui                     Disable user interface
   -p, --package <PACKAGE>         Package containing fuzz target
       --persistent                Enable persistent mode fuzzing
-      --pretty                    Pretty-print debug output when displaying/replaying
+      --pretty                    Pretty-print debug output when generating coverage, displaying, or
+                                  replaying
       --release                   Build in release mode
       --replay <OBJECT>           Replay corpus, crashes, hangs, or work queue. By default, an
                                   uninstrumented fuzz target is used. To replay with
@@ -317,7 +325,8 @@ Options:
       --test <NAME>               Integration test containing fuzz target
       --timeout <TIMEOUT>         Number of seconds to consider a hang when fuzzing or replaying
                                   (equivalent to -- -t <TIMEOUT * 1000> when fuzzing)
-      --verbose                   Show build output when displaying/replaying
+      --verbose                   Show build output when generating coverage, displaying, or
+                                  replaying
   -h, --help                      Print help
   -V, --version                   Print version
 

cargo-test-fuzz/Cargo.toml

@@ -47,6 +47,7 @@ runtime = { workspace = true }
 assert_cmd = { workspace = true }
 predicates = { workspace = true }
 rlimit = { workspace = true }
+snapbox = { workspace = true }
 tempfile = { workspace = true }
 walkdir = { workspace = true }
 xshell = { workspace = true }

cargo-test-fuzz/src/bin/cargo_test_fuzz/transition.rs

@@ -34,6 +34,13 @@ struct TestFuzzWithDeprecations {
     consolidate: bool,
     #[arg(long, hide = true)]
     consolidate_all: bool,
+    #[arg(
+        long,
+        help = "Generate coverage for corpus, crashes, hangs, or work queue. By default, an \
+                uninstrumented fuzz target is used. To generate coverage with instrumentation, \
+                append `-instrumented` to <OBJECT>, e.g., --coverage corpus-instrumented."
+    )]
+    coverage: Option<Object>,
     #[arg(
         long,
         value_name = "N",
@@ -89,7 +96,7 @@ struct TestFuzzWithDeprecations {
     persistent: bool,
     #[arg(
         long,
-        help = "Pretty-print debug output when displaying/replaying",
+        help = "Pretty-print debug output when generating coverage, displaying, or replaying",
         alias = "pretty-print"
     )]
     pretty: bool,
@@ -136,7 +143,10 @@ struct TestFuzzWithDeprecations {
                 -t <TIMEOUT * 1000> when fuzzing)"
     )]
     timeout: Option<u64>,
-    #[arg(long, help = "Show build output when displaying/replaying")]
+    #[arg(
+        long,
+        help = "Show build output when generating coverage, displaying, or replaying"
+    )]
     verbose: bool,
     #[arg(
         value_name = "TARGETNAME",
@@ -153,6 +163,7 @@ impl From<TestFuzzWithDeprecations> for super::TestFuzz {
             backtrace,
             consolidate,
             consolidate_all,
+            coverage,
             cpus,
             display,
             exact,
@@ -191,6 +202,7 @@ impl From<TestFuzzWithDeprecations> for super::TestFuzz {
             backtrace,
             consolidate,
             consolidate_all,
+            coverage,
             cpus,
             display,
             exact,