Index: compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.h =================================================================== --- compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.h +++ compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.h @@ -196,9 +196,20 @@ Handle8bitCounter(FirstFeature, P - Begin, V); } -// Given a non-zero Counters returns a number in [0,7]. +// Given a non-zero Counter returns a number in the range [0,7]. template unsigned CounterToFeature(T Counter) { + // Returns a feature number by placing Counters into buckets as illustrated + // below. + // + // Counter bucket: [1] [2] [3] [4-7] [8-15] [16-31] [32-127] [128+] + // Feature number: 0 1 2 3 4 5 6 7 + // + // This is a heuristic taken from AFL (see + // http://lcamtuf.coredump.cx/afl/technical_details.txt). + // + // This implementation may change in the future so clients should + // not rely on it. assert(Counter); unsigned Bit = 0; /**/ if (Counter >= 128) Bit = 7;