Improve readme and new coverage

Author: tmpolaczyk

README.md

@@ -23,20 +23,48 @@ cargo fuzz run fuzz_raw -j8
 
 Uncomment the `println!` calls for a more verbose output.
 
-# Coverage
+# Coverage v3
+
+Run all these commands from inside "fuzz" folder:
+
+Optionally, remove old coverage runs from `proffiles` folder.
+
+Modify `target_name` in `run_coverage.py`
+
+Run it
+
+```
+rustup component add llvm-tools-preview
+grcov proffiles/ -s $HOME --binary-path ./target/x86_64-unknown-linux-gnu/debug -t html --branch --ignore-not-existing --ignore "target/debug/build/*" --ignore "*mock.rs" --ignore "*tests.rs"             -o coverage --llvm
+```
+
+Will put coverage from `proffiles/*` into `coverage` folder.
+
+Open `coverage/index.html` to see it.
+
+To upload the coverage to github pages:
 
 ```
-cd fuzz
-cargo fuzz coverage fuzz_raw
-$HOME/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/bin/llvm-cov show target/x86_64-unknown-linux-gnu/coverage/x86_64-unknown-linux-gnu/release/fuzz_raw     --format=html     -instr-profile=coverage/fuzz_raw/coverage.profdata  --ignore-filename-regex='.*/\.cargo/.*'   > index.html
-firefox index.html
+git checkout gh-pages
+cp -rf fuzz/coverage_tmpname coverage/{target_name}
+# update index.html if new target
+git add coverage
+git commit -a --amend
+git push -f
+git checkout -
 ```
 
-# Coverage v2
+# Profiling
+
+You can run perf on the fuzzer binary as is.
+
+Delete the corpus if you want to see performance with an empty corpus, or keep the corpus to see performance when processing the corpus.
 
 ```
-RUSTFLAGS="--cfg fuzzing -C opt-level=3 -C target-cpu=native -C instrument-coverage" cargo run --bin fuzz_raw_coverage
-# rm -rf proffiles/*
-# Then run:
-grcov proffiles/ -s $HOME --binary-path ./target/x86_64-unknown-linux-gnu/debug -t html --branch --ignore-not-existing --ignore "target/debug/build/*" --ignore "*mock.rs" --ignore "*tests.rs"             -o coverage3/ --llvm
+echo -1 | sudo tee /proc/sys/kernel/perf_event_paranoid
+# Copy the fuzzer command here, it is printed when running cargo fuzz
+perf record --call-graph=dwarf target/x86_64-unknown-linux-gnu/release/fuzz_starlight_live_oneblock_events -artifact_prefix=/home/tomasz/projects/fuzz-tanssi-runtime/fuzz/artifacts/fuzz_starlight_live_oneblock_events /home/tomasz/projects/fuzz-tanssi-runtime/fuzz/corpus/fuzz_starlight_live_oneblock_events
+perf script | inferno-collapse-perf > stacks.folded
+cat stacks.folded | inferno-flamegraph > flamegraph.svg
+# open in a web browser flamegraph.svg
 ```

fuzz/Cargo.toml

@@ -76,6 +76,13 @@ test = false
 doc = false
 bench = false
 
+[[bin]]
+name = "fuzz_starlight_live_oneblock_events_coverage"
+path = "fuzz_targets/fuzz_starlight_live_oneblock_events_coverage.rs"
+test = false
+doc = false
+bench = false
+
 [dependencies]
 #dancebox-runtime = { path = "../../tanssi/chains/orchestrator-paras/runtime/dancebox", default-features = false, features = [ "std", "try-runtime", "fast-runtime" ] }
 #flashbox-runtime = { path = "../../tanssi/chains/orchestrator-paras/runtime/flashbox", default-features = false, features = [ "std", "try-runtime", "fast-runtime" ] }

fuzz/fuzz_targets/fuzz_starlight_live_oneblock_events.rs

@@ -1491,6 +1491,7 @@ fn fuzz_init() {
     list_type_ids(&METADATA.types);
 }
 
+// Anything below this line will not be included in the coverage script
 libfuzzer_sys::fuzz_target!(init: fuzz_init(), |data: &[u8]| fuzz_main(data));
 
 fn extrinsics_iter_ignore_errors(mut extrinsic_data: &[u8]) -> impl Iterator<Item = RuntimeCall> + use<'_> {

fuzz/run_coverage.py

@@ -129,7 +129,7 @@ def upload_to_ghpages(target_name):
     """
 
 def main():
-    target_name = "fuzz_starlight"
+    target_name = "fuzz_starlight_live_oneblock_events"
     setup_coverage_target(target_name)
     write_coverage_target(target_name, 'fuzz_targets/coverage.rs', f"fuzz_targets/{target_name}.rs", f"fuzz_targets/{target_name}_coverage.rs")
     build_coverage_binary(target_name)