research feature: tracking branches taken to form branch probabilities about fuzzbench

[jonathanmetzman]

We've wanted to do something like this too, since I suspect there are cases where fuzzers that find less edges are actually finding edges not found by others, and have use there as well.

During an experiment, we have data on which edges in a program are covered by each fuzzer.
However, we don't save it anywhere.
Thus the first step in implementing this feature would be saving this data somewhere. That should be pretty easy.
I think figuring out a way to present this data in a way that is understandable requires more thought.

[jonathanmetzman]

We have a feature that is very similar to this being implemented by #657.
Instead of listing the probability of each edge, we allow users to see how unique the coverage of one fuzzer is in relation to all other fuzzers or to another individual fuzzer.
I think this feature (although there are many ways it can be improved, like being able to answer "how unique is AFL compared to libFuzzer+Honggfuzz" for example) is a bit more useful version of the one suggested by this issue.
@roachspray do you agree?

[roachspray]

I see this -- I must read #657 and will respond shortly. Thank you!

[roachspray]

@jonathanmetzman Thank you for sharing this. One of my goals for branch probabilities was to discover/investigate roadblock branches (infrequently taken paths) across different fuzzers. If I am able to map regions, with coverage, back to code, then that is good enough, I think. I need to re-visit region definition to be sure.