symcc_fuzzing_helper SYMCC_AFL_COVERAGE_MAP doesnt work about symcc

[julihoh]

I had exactly the same thought, but I think the idea might be to set this configuration to a separate file, to at least let qsym track its own coverage (without necessarily coordinating with afl's map).

[sebastianpoeplau]

I'm not sure I understand. We use afl-showmap exclusively to decide whether to pass a test case to the fuzzer, and we run it with the same binary that the fuzzer uses. So from AFL's point of view it should be correct that a test case for which afl-showmap lists edges that it hasn't listed for previous test cases is interesting.

Then there is the separate concept of SYMCC_AFL_COVERAGE_MAP, which is the QSYM backend's internal mechanism to make branch decisions based on previous explorations. It is modeled after the AFL maps but completely independent from afl-showmap and based only on executions of the SymCC-instrumented binary.