[coverage] __noreturn__ attribute leads to incorrect coverage report

[justincady]

The __noreturn__ attribute appears to invalidate coverage of the following line, whereas _Noreturn demonstrates correct behavior.

// coverage.c
#include <stdio.h>

__attribute__ ((__noreturn__)) void foo(void) { while (1); }
_Noreturn void bar(void) { while (1); }

int main(int argc, char **argv) {
    int rc = ({ if (argc > 3) foo(); 0; });
    printf("coverage after foo is missing\n");

    int rc2 = ({ if (argc > 3) bar(); 0; });
    printf("coverage after bar is present\n");
    return rc + rc2;
}

# build.sh
/usr/bin/clang --version | /bin/grep "clang version"
/usr/bin/clang -fprofile-instr-generate -fcoverage-mapping coverage.c -o coverage
./coverage
/usr/bin/llvm-profdata merge -sparse default.profraw -o default.profdata
/usr/bin/llvm-cov show ./coverage -instr-profile=default.profdata

Running the script:

$ ./build.sh
clang version 19.1.1 (Red Hat, Inc. 19.1.1-5.el10)
coverage after foo is missing
coverage after bar is present
    1|       |#include <stdio.h>
    2|       |
    3|      0|__attribute__ ((__noreturn__)) void foo(void) { while (1); }
    4|      0|_Noreturn void bar(void) { while (1); }
    5|       |
    6|      1|int main(int argc, char **argv) {
    7|      1|    int rc = ({ if (argc > 3) foo(); 0; });
    8|      0|    printf("coverage after foo is missing\n");
    9|       |
   10|      1|    int rc2 = ({ if (argc > 3) bar(); 0; });
   11|      1|    printf("coverage after bar is present\n");
   12|      1|    return rc + rc2;
   13|      1|}

$

• Line 8 is reported as uncovered, though it prints as expected. (incorrect behavior)
• Line 11 is reported as covered, and prints as expected. (correct behavior)

This seems like a bug connected to __noreturn__. FWIW I also tested this in C++ and observed the same results.

[justincady]

Adding @chapuni who has made some recent changes related to coverage mapping. Do you have any thoughts as to what area could be problematic here? Thanks!

[justincady]

cc @ZequanWu who may also be able to provide some guidance.

[ZequanWu]

You can add -Xclang -dump-coverage-mapping to get the coverage mapping info generated by clang and check what is not working. I guess it's a bug on how termination region is created:

llvm-project/clang/lib/CodeGen/CoverageMappingGen.cpp

Line 1312 in 09d945d

void terminateRegion(const Stmt *S) {

[justincady]

Reduced example with -Xclang -dump-coverage-mapping:

$ ./build.sh
clang version 19.1.7
foo:
  File 0, 4:16 -> 4:29 = #0
  File 0, 4:24 -> 4:25 = (#0 + #1)
  Branch,File 0, 4:24 -> 4:25 = 0, 0
  File 0, 4:26 -> 4:27 = #1
main:
  File 0, 6:33 -> 10:2 = #0
  File 0, 7:21 -> 7:29 = #0
  Branch,File 0, 7:21 -> 7:29 = #1, (#0 - #1)
  Gap,File 0, 7:30 -> 7:31 = #1
  File 0, 7:31 -> 7:36 = #1
  Gap,File 0, 7:37 -> 7:38 = (#0 - #1)
  File 0, 7:38 -> 9:14 = (#0 - #1)
  Gap,File 0, 7:44 -> 8:5 = 0
coverage after foo is missing
    1|       |#include <stdio.h>
    2|       |
    3|       |__attribute__ ((__noreturn__))
    4|      0|void foo(void) { while(1); }
    5|       |
    6|      1|int main(int argc, char **argv) {
    7|      1|    int rc = ({ if (argc > 3) foo(); 0; });
    8|      0|    printf("coverage after foo is missing\n");
    9|      1|    return rc;
   10|      1|}

Same example, but with __attribute__ ((__noreturn__)) commented out:

$ ./build.sh
clang version 19.1.7
foo:
  File 0, 4:16 -> 4:29 = #0
  File 0, 4:24 -> 4:25 = (#0 + #1)
  Branch,File 0, 4:24 -> 4:25 = 0, 0
  File 0, 4:26 -> 4:27 = #1
main:
  File 0, 6:33 -> 10:2 = #0
  File 0, 7:21 -> 7:29 = #0
  Branch,File 0, 7:21 -> 7:29 = #1, (#0 - #1)
  Gap,File 0, 7:30 -> 7:31 = #1
  File 0, 7:31 -> 7:36 = #1
coverage after foo is missing
    1|       |#include <stdio.h>
    2|       |
    3|       |//__attribute__ ((__noreturn__))
    4|      0|void foo(void) { while(1); }
    5|       |
    6|      1|int main(int argc, char **argv) {
    7|      1|    int rc = ({ if (argc > 3) foo(); 0; });
    8|      1|    printf("coverage after foo is missing\n");
    9|      1|    return rc;
   10|      1|}

Here's the coverage mapping diff (only present with __noreturn__ active):

  Gap,File 0, 7:37 -> 7:38 = (#0 - #1)
  File 0, 7:38 -> 9:14 = (#0 - #1)
  Gap,File 0, 7:44 -> 8:5 = 0

• A gap region covering 0 following the __noreturn__ call
• A new region following that to the end of main
• A gap region from the trailing newline of line 7 to the start of printf

I do not yet understand why these new mappings result in line 8 being marked uncovered.

[justincady]

Commenting out this block in clang/lib/CodeGen/CoverageMappingGen.cpp resolves the __noreturn__ issue as described above:

  void VisitCallExpr(const CallExpr *E) {
    VisitStmt(E);

    // Terminate the region when we hit a noreturn function.
    // (This is helpful dealing with switch statements.)
   /*
    QualType CalleeType = E->getCallee()->getType();
    if (getFunctionExtInfo(*CalleeType).getNoReturn())
      terminateRegion(E);
   */
  }

That's obviously not the answer. But it seems possible this code needs to be modified to terminate the region differently (or perhaps different cases must be handled).

[justincady]

I hacked together a change that eliminates the final Gap,File 0, 7:44 -> 8:5 = 0 region: I avoided assigning HasTerminateStmt = true when terminateRegion is called from VisitCallExpr.

Effectively this change removes only the last region that appears with __noreturn__ is in place. When I do that, the printf call is correctly shown as covered.

I'm confused by this result though. Given the output without my change (from the earlier __noreturn__ example):

main:
  File 0, 6:33 -> 10:2 = #0
  File 0, 7:21 -> 7:29 = #0
  Branch,File 0, 7:21 -> 7:29 = #1, (#0 - #1)
  Gap,File 0, 7:30 -> 7:31 = #1
  File 0, 7:31 -> 7:36 = #1
  Gap,File 0, 7:37 -> 7:38 = (#0 - #1)
  File 0, 7:38 -> 9:14 = (#0 - #1)
  Gap,File 0, 7:44 -> 8:5 = 0

The printf call is on line 8. The final Gap region covers the trailing newline of line 7 and the leading spaces of line 8 to the start of the printf CallExpr. But wouldn't the actual printf CallExpr counter value be File 0, 7:38 -> 9:14 = (#0 - #1) as it's the most specific region pertaining to line 8?

I'm happy to make and test whatever change is required to resolve this issue, but I think I'm missing something fundamental here. (It's the first time I'm looking into coverage implementation.)

@evodius96 or @vedantk would you be able to help clarify?

[justincady]

Hm, could the -debug flag indicate this is actually an llvm-cov issue?

$ llvm-cov show -debug ./coverage -instr-profile=default.profdata
[...]
Combined regions:
  4:16 -> 4:29 (count=0)
  4:24 -> 4:25 (count=0)
  4:26 -> 4:27 (count=0)
  6:33 -> 10:2 (count=1)
  7:21 -> 7:29 (count=1)
  7:30 -> 7:31 (count=0)
  7:31 -> 7:36 (count=0)
  7:37 -> 7:38 (count=1)
  7:38 -> 9:14 (count=1)
  7:44 -> 8:5 (count=0)
Segment at 4:16 (count = 0), RegionEntry
Segment at 4:24 (count = 0), RegionEntry
Segment at 4:25 (count = 0)
Segment at 4:26 (count = 0), RegionEntry
Segment at 4:27 (count = 0)
Segment at 4:29 (count = 0), Skipped
Segment at 6:33 (count = 1), RegionEntry
Segment at 7:21 (count = 1), RegionEntry
Segment at 7:29 (count = 1)
Segment at 7:30 (count = 0), Gap
Segment at 7:31 (count = 0), RegionEntry
Segment at 7:36 (count = 1)
Segment at 7:38 (count = 1), RegionEntry
Segment at 7:44 (count = 0), Gap
Segment at 8:5 (count = 1) <-------------------- Does this mean the coverage data knows this line segment (after leading spaces) was executed?
Segment at 10:2 (count = 0), Skipped
    1|       |#include <stdio.h>
    2|       |
    3|       |__attribute__ ((__noreturn__))
    4|      0|void foo(void) { while(1); }
    5|       |
    6|      1|int main(int argc, char **argv) {
    7|      1|    int rc = ({ if (argc > 3) foo(); 0; });
    8|      0|    printf("coverage after foo is missing\n");
    9|      1|    return rc;
   10|      1|}

[justincady]

My current belief is this is actually related to the handling of GNU statement expressions. I'm experimenting with a potential fix.