fabCic
fabCic

Reputation: 31

Does KLEE symbolic execution support code coverage with gcov or other tools?

I am trying to obtain code coverage information from KLEE executions. Does KLEE support gcov? I know KLEE provides general coverage information in the istats files, but I want to combine the coverage from multiple executions to obtain the total coverage.

My program involves two files that I compile and link together with the following commands (I only care about coverage for the first file test_program.c):

clang-9 -I$KLEE_HOME/include -emit-llvm -c -g -O0 -Xclang -disable-O0-optnone --coverage test_program.c

clang-9 -I$KLEE_HOME/include -emit-llvm -c -g -O0 -Xclang -disable-O0-optnone utility_program.c

llvm-link-9 test_program.bc utility_program.bc -o target_file.bc

And then run KLEE with the command:

klee --libc=uclibc --posix-runtime --only-output-states-covering-new --external-calls=all target_file.bc

But it seems that KLEE does not support gcov as I get the following output:

KLEE: WARNING: undefined reference to function: llvm_gcda_emit_arcs
KLEE: WARNING: undefined reference to function: llvm_gcda_emit_function
KLEE: WARNING: undefined reference to function: llvm_gcda_end_file
KLEE: WARNING: undefined reference to function: llvm_gcda_start_file
KLEE: WARNING: undefined reference to function: llvm_gcda_summary_info
KLEE: WARNING: undefined reference to function: llvm_gcov_init
KLEE: WARNING ONCE: calling external: llvm_gcov_init(94767398774408, 94767398772872) at [no debug info]
KLEE: ERROR: (location information missing) failed external call: llvm_gcov_init

Is it possible to use gcov in KLEE? If not, does KLEE provide tools to aggregate the coverage from multiple executions?

Thank you for your help!

Upvotes: 2

Views: 90

Answers (0)

Related Questions