Roll AFL 2.31b:2.38b and switch coverage to use trace-pc-guard.

third_party/afl/src/config.h

 /*
    american fuzzy lop - vaguely configurable bits
    ----------------------------------------------
 
    Written and maintained by Michal Zalewski <lcamtuf@google.com>
 
    Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at:
 
      http://www.apache.org/licenses/LICENSE-2.0
 
  */
 
 #ifndef _HAVE_CONFIG_H
 #define _HAVE_CONFIG_H
 
 #include "types.h"
 
 /* Version string: */
 
-#define VERSION             "2.31b"
+#define VERSION             "2.38b"
 
 /******************************************************
  *                                                    *
  *  Settings that may be of interest to power users:  *
  *                                                    *
  ******************************************************/
 
 /* Comment out to disable terminal colors (note that this makes afl-analyze
    a lot less nice): */
 
@@ skipping 73 matching lines @@
 
 /* Probabilities of skipping non-favored entries in the queue, expressed as
    percentages: */
 
 #define SKIP_TO_NEW_PROB    99 /* ...when there are new, pending favorites */
 #define SKIP_NFAV_OLD_PROB  95 /* ...no new favs, cur entry already fuzzed */
 #define SKIP_NFAV_NEW_PROB  75 /* ...no new favs, cur entry not fuzzed yet */
 
 /* Splicing cycle count: */
 
-#define SPLICE_CYCLES       16
+#define SPLICE_CYCLES       15
 
 /* Nominal per-splice havoc cycle length: */
 
 #define SPLICE_HAVOC        32
 
 /* Maximum offset for integer addition / subtraction stages: */
 
 #define ARITH_MAX           35
 
 /* Limits for the test case trimmer. The absolute minimum chunk size; and
@@ skipping 207 matching lines @@
 
 // #define SKIP_COUNTS
 
 /* Uncomment this to use instrumentation data to record newly discovered paths,
    but do not use them as seeds for fuzzing. This is useful for conveniently
    measuring coverage that could be attained by a "dumb" fuzzing algorithm: */
 
 // #define IGNORE_FINDS
 
 #endif /* ! _HAVE_CONFIG_H */