pub struct CoverageReport {
pub covered_offsets: u32,
pub bitmap_size: u32,
pub bitmap: Vec<u8>,
}Expand description
Bytecode coverage tracking.
When enabled, the QuickJS interpreter records which bytecode offsets
execute. This is essential for:
- Fuzzing feedback — Soleno’s MCTS uses coverage to guide exploration. Inputs that cover new bytecodes score higher.
- Detonation completeness — Sear verifies that the payload actually executed (not just parsed) by checking coverage against the script’s bytecode.
- Evasion detection — if a script has bytecodes that never execute regardless of input, those may be dead code or environment-gated payloads.
§How it works
- Host allocates a coverage bitmap in WASM linear memory via
jsdet_alloc - Host calls
jsdet_set_coverage(bitmap_ptr, size)to register it QuickJSinterpreter sets bits as bytecodes execute- After execution, host reads the bitmap back
jsdet_count_coverage()returns the number of executed bytecodesjsdet_clear_coverage()resets for the next run
The bitmap is bit-packed: byte N, bit M = bytecode offset (N*8 + M).
Coverage statistics from one execution.
Fields§
§covered_offsets: u32Total bytecode offsets covered (bits set in the bitmap).
bitmap_size: u32Size of the coverage bitmap in bytes.
bitmap: Vec<u8>Raw bitmap data (for differential analysis between runs).
Implementations§
Source§impl CoverageReport
impl CoverageReport
Sourcepub fn coverage_ratio(&self) -> f64
pub fn coverage_ratio(&self) -> f64
Coverage ratio: covered / (bitmap_size * 8).
Sourcepub fn new_coverage_since(&self, previous: &CoverageReport) -> u32
pub fn new_coverage_since(&self, previous: &CoverageReport) -> u32
Count new offsets covered compared to a previous run. This is the MCTS reward signal — new coverage = high reward.
Sourcepub fn merge(&mut self, other: &CoverageReport)
pub fn merge(&mut self, other: &CoverageReport)
Merge coverage from another report (union of bitmaps).
Trait Implementations§
Source§impl Clone for CoverageReport
impl Clone for CoverageReport
Source§fn clone(&self) -> CoverageReport
fn clone(&self) -> CoverageReport
Returns a duplicate of the value. Read more
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
Performs copy-assignment from
source. Read moreSource§impl Debug for CoverageReport
impl Debug for CoverageReport
Source§impl Default for CoverageReport
impl Default for CoverageReport
Source§fn default() -> CoverageReport
fn default() -> CoverageReport
Returns the “default value” for a type. Read more
Auto Trait Implementations§
impl Freeze for CoverageReport
impl RefUnwindSafe for CoverageReport
impl Send for CoverageReport
impl Sync for CoverageReport
impl Unpin for CoverageReport
impl UnsafeUnpin for CoverageReport
impl UnwindSafe for CoverageReport
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more