Code Coverage with gcov

Purpose

Instrument C/C++ programs with gcov to measure test coverage.

Containment

The instrumented project is untrusted — its build scripts and the produced binary execute arbitrary code, and the .gcda/.gcno files that binary emits are untrusted bytes parsed by gcov/gcovr. Run every build, target-binary/test-suite execution, and gcov/gcovr invocation via libexec/raptor-run-sandboxed --output-dir <dir> <cmd> [args...] (--output-dir = the directory the command writes into). If a sandboxed step fails, fix the sandboxed invocation — never run the target's build system, binary, or the coverage extraction bare.

How It Works

Build with Coverage (sandboxed)

libexec/raptor-run-sandboxed --output-dir <project-dir> gcc --coverage -o program source.c