cov experiment

.gitignore

*.o
*.a
example_cc
example_rs

example.cc

// example.cc
void foo() { }

int main(int argc, char **argv) {
  if (argc > 1) foo();
}

example.rs

// example.rs

#![allow(unused)]

use std::env;

fn foo() -> () {}

fn main() {
    let mut args = env::args_os();
    if let Some(_) = args.next() {
        foo()
    }
}

Makefile

.PHONY: all clean

all: example_cc example_rs

clean:
	-rm *.o
	-rm *.a
	-rm example_cc
	-rm example_rs

## Common

libtracer.a:
	rustc --crate-type staticlib tracer.rs

## C++

example_cc.o:
	clang++ -g -fsanitize-coverage=trace-pc-guard example.cc -c -o example_cc.o

example_cc: libtracer.a example_cc.o
	clang++ libtracer.a example_cc.o -fsanitize=address -o example_cc

## Rust

example_rs.o:
	RUSTFLAGS="-Cllvm-args=-sanitizer-coverage-trace-pc-guard" rustc --emit obj example.rs -o example_rs.o

example_rs: libtracer.a example_rs.o
	clang++ libtracer.a example_rs.o -fsanitize=address -o example_rs

tracer.rs

// tracer.rs

// This callback is inserted by the compiler as a module constructor
// into every DSO. 'start' and 'stop' correspond to the
// beginning and end of the section with the guards for the entire
// binary (executable or DSO). The callback will be called at least
// once per DSO and may be called multiple times with the same parameters.
#[no_mangle]
pub extern "C" fn __sanitizer_cov_trace_pc_guard_init(start: *mut u32, stop: *mut u32) -> () {
    println!("START: {:?}", start);
    println!("STOP: {:?}", stop);
}

// This callback is inserted by the compiler on every edge in the
// control flow (some optimizations apply).
// Typically, the compiler will emit the code like this:
//    if(*guard)
//      __sanitizer_cov_trace_pc_guard(guard);
// But for large functions it will emit a simple call:
//    __sanitizer_cov_trace_pc_guard(guard);
#[no_mangle]
pub extern "C" fn __sanitizer_cov_trace_pc_guard(guard: *const u32) -> () {
    println!("GUARD: {:?}", guard);
}