Basic Block Coverage

Concept

Basic Block Coverage (BBC) is a code coverage metric and secondary search objective that tracks which basic blocks (BBs) of a program's control flow graph have been executed. It is used to complement branch- and line-level coverage in software testing and fuzzing, exposing implicit runtime branchings (such as exceptions inside branchless methods) that explicit conditional/loop branches do not capture. Empirical studies show BBC improves branch coverage in search-based unit test generation and accelerates search-based crash reproduction.

First seen 7/12/2026

Last seen 7/12/2026

Evidence 1 chunks

Wiki v1

WIKI

Basic Block Coverage

Definition

A basic block (BB) is a maximal straight-line sequence of instructions in a program's control flow graph (CFG) with a single entry point and a single exit point, containing no internal branches or branch targets. Basic Block Coverage (BBC) is the fraction (or set) of basic blocks that have been executed at least once during a program's run. Instrumentation reports either a Boolean per-BB hit map or a histogram of per-BB execution counts.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

LINKED ENTITIES

4 links

control flow graph related_to BBC is defined over the basic blocks of a program's control flow graph.

Branch Coverage related_to BBC complements branch coverage by exposing implicit branchings that explicit branches miss.

American Fuzzy Lop related_to AFL is a coverage-guided fuzzer that uses BB-level instrumentation via LLVM/GCC and QEMU.

CITATIONS

7 sources

7 citations — click to expand

[1] BBC is introduced as a secondary objective that accounts for coverage level of relevant basic blocks in the control flow graph. Basic Block Coverage for Search-based Unit Testing and Crash Reproduction

[2] BBC improves branch coverage by around 1.5% in DynaMOSA-based unit test generation and increases output domain coverage, implicit runtime exception coverage, and runtime state diversity. Basic Block Coverage for Search-based Unit Testing and Crash Reproduction

[3] With STDistance and WeightedSum fitness functions, BBC reproduces 3 new crashes per fitness function and significantly reduces reproduction time for 43.5% (STDistance) and 45.1% (WeightedSum) of crashes, by 71.7% and 68.7% on average respectively. Basic Block Coverage for Search-based Unit Testing and Crash Reproduction

[4] LTP achieves about 35% basic-block coverage of the VFS subsystem, and augmenting LTP with coverage-guided benchmark programs raises VFS basic-block coverage by 26.1 percentage points. Improving Linux-Kernel Tests for LockDoc with Feedback-driven Fuzzing

[5] Basic block instrumentation records which basic block has been executed and may count the number of executions visualized as a BB histogram; CF edge coverage tracks taken CF edges. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing

[6] AFL uses LLVM and GCC for target instrumentation and a QEMU mode for non-native ISAs, with QEMU mode runtime overhead between 2x and 5x. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing

[7] AFL++ and libFuzzer transformations can split complex conditions across multiple basic blocks so the fuzzer receives feedback on each partial condition. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing