How do the code coverage options of GCC work?

Question

Consider the following command:

gcc -fprofile-arcs -ftest-coverage main.c

It generates the file, main.gcda, which is to be used by gcov, to generate the coverage analysis. So how does main.gcda is generated? How the instrumentation is done? Can I see the instrumented code?

Answer 1

.gcda is not generated by compiler; it's generated by your program when you execute it.

.gcno is the file generated at compilation time and it is the 'note file'. gcc generate a basic block graph notes file (.gcno) for each CU(compiler unit).

So how does main.gcda is generated?

At running time the statistic data is gathered and stored in memory. Some exit callback is registered and is called to write the data to the .gcda file when the program terminates. This means if you call abort() instead of exit() in your program, no .gcda file would be generated.

How the instrumentation is done? Can I see the instrumented code?

You way need check gcc's implementation to get the details but basically the instrumentation is done by inserting instruction to the program to count the number of times each instruction is executed. But it doesn't really have to keep a counter for each instruction; GCC uses some algorithm to generate a program flow graph and finds a spanning tree for the graph. Only some special arcs have to be instrumented and from them the coverage of all code branches can be generated. You can disassemble the binary to see the instrumented code. And here are some files for coverage if you want to look into the gcc source file:

toplev.c coverage.c profile.c libgcov.c gcov.c gcov-io.c

edit: some known gcov bugs FYI:

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49484

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28441

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44779

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=7970