SANCOV(1)

📦 version 12.0.1, in ubuntu jammy

🌸 NAME 🌸

sancov — manual page for sancov 12. yeah bestie, that's the whole name section, it's giving minimal. this is the man page for the Sanitizer Coverage Processing Tool, and it's sancov(1) if you're being formal about it 💅

🦋 DESCRIPTION 🦋

✨ OVERVIEW: Sanitizer Coverage Processing Tool (`sancov`) ✨

okay so picture this: sancov is your little coverage goblin 🧚 and what it does is extract various coverage-related information from a whole bunch of places:

coverage-instrumented binary files
raw .sancov files
and their symbolized .symcov version

and here's the tea — depending on which action you pick, the tool expects different input files, so pls don't just throw everything at it and hope 🙈

-print-coverage-pcs — this one wants coverage-instrumented binary files
-print-coverage — this one wants .sancov files
<other actions> — these want .sancov files & corresponding binary files, plus .symcov files

⭐ USAGE ⭐

sancov [options] <action> <binary files...> <.sancov files...> <.symcov files...>

🎀 OPTIONS 🎀

🌈 Color Options 🌈

--color — use colors in the output (default=autodetect). she's automatic about it, she just knows 💅

💖 General options 💖

okay this next part is LONG, like, scroll-for-days long, but every single one of these is real and we're going through all of them, no skipping, we're not cowards:

--aarch64-neon-syntax=<value> — choose which style of NEON code to emit from the AArch64 backend:
- =generic — emit generic NEON assembly
- =apple — emit Apple-style NEON assembly
--abort-on-max-devirt-iterations-reached — abort when the max iterations for the devirtualization CGSCC repeat pass is reached
--amdgpu-bypass-slow-div — skip the 64-bit divide for dynamic 32-bit values
--amdgpu-disable-loop-alignment — do not align and prefetch loops
--amdgpu-disable-power-sched — disable scheduling to minimize mAI power bursts
--amdgpu-dpp-combine — enable DPP combiner
--amdgpu-dump-hsa-metadata — dump AMDGPU HSA Metadata
--amdgpu-enable-flat-scratch — use flat scratch instructions
--amdgpu-enable-merge-m0 — merge and hoist M0 initializations
--amdgpu-promote-alloca-to-vector-limit=<uint> — maximum byte size to consider promote alloca to vector
--amdgpu-reserve-vgpr-for-sgpr-spill — allocates one VGPR for future SGPR Spill
--amdgpu-sdwa-peephole — enable SDWA peepholer
--amdgpu-use-aa-in-codegen — enable the use of AA during codegen.
--amdgpu-verify-hsa-metadata — verify AMDGPU HSA Metadata
--amdgpu-vgpr-index-mode — use GPR indexing mode instead of movrel for vector indexing
--arm-add-build-attributes — (no description, she's mysterious, she contains multitudes 🫶)
--arm-implicit-it=<value> — allow conditional instructions outdside of an IT block (yes, that typo is canon, we keep it exactly as it is):
- =always — accept in both ISAs, emit implicit ITs in Thumb
- =never — warn in ARM, reject in Thumb
- =arm — accept in ARM, reject in Thumb
- =thumb — warn in ARM, emit implicit ITs in Thumb
--atomic-counter-update-promoted — do counter update using atomic fetch add for promoted counters only
--atomic-first-counter — use atomic fetch add for the first counter in a function (usually the entry counter)
--blacklist=<string> — blacklist file (sanitizer blacklist format).
--bounds-checking-single-trap — use one trap block per function
--cfg-hide-deoptimize-paths — (again, no description, we respect her privacy 😌)
--cfg-hide-unreachable-paths — (same, no description given)
--cost-kind=<value> — target cost kind:
- =throughput — reciprocal throughput
- =latency — instruction latency
- =code-size — code size
- =size-latency — code size and latency

👑 Action (required) 👑

bestie this bit is required, like, do not skip it, the vibe check will fail:

--print — print coverage addresses
--print-coverage-pcs — print coverage instrumentation points addresses.
--covered-functions — print all covered funcions. (spelling preserved, iconic, no notes)
--not-covered-functions — print all not covered funcions.
--print-coverage-stats — print coverage statistics.
--html-report — REMOVED. use -symbolize & coverage-report-server.py. she's gone girl, she left the chat 💀
--symbolize — produces a symbolized JSON report from binary report.
--merge — merges reports.
--cvp-dont-add-nowrap-flags — (no description listed, lowkey a mystery 🕵️)
--debugify-level=<value> — kind of debug info to add:
- =locations — locations only
- =location+variables — locations and variables
--debugify-quiet — suppress verbose debugify output
--demangle — print demangled function name.
--disable-promote-alloca-to-lds — disable promote alloca to LDS
--disable-promote-alloca-to-vector — disable promote alloca to vector
--do-counter-promotion — do counter register promotion
--dot-cfg-mssa=<file name for generated dot file> — file name for generated dot file
--emscripten-cxx-exceptions-allowed=<string> — the list of function names in which Emscripten-style exception handling is enabled (see emscripten EMSCRIPTEN_CATCHING_ALLOWED options)
--enable-cse-in-irtranslator — should enable CSE in irtranslator
--enable-cse-in-legalizer — should enable CSE in Legalizer
--enable-emscripten-cxx-exceptions — WebAssembly Emscripten-style exception handling
--enable-emscripten-sjlj — WebAssembly Emscripten-style setjmp/longjmp handling
--enable-gvn-hoist — enable the GVN hoisting pass (default = off)
--enable-gvn-memdep — (no description given, we simply don't know her like that 🙈)
--enable-gvn-sink — enable the GVN sinking pass (default = off)
--enable-load-in-loop-pre — (no description)
--enable-load-pre — (no description)
--enable-loop-simplifycfg-term-folding — (no description)
--enable-name-compression — enable name/filename string compression
--enable-split-backedge-in-load-pre — (no description)
--gpsize=<uint> — Global Pointer Addressing Size. the default size is 8.
--hash-based-counter-split — rename counter variable of a comdat function based on cfg hash
--hot-cold-split — enable hot-cold splitting pass
--import-all-index — import all external functions in index.
--instcombine-code-sinking — enable code sinking
--instcombine-guard-widening-window=<uint> — how wide an instruction window to bypass looking for another guard
--instcombine-max-iterations=<uint> — limit the maximum number of instruction combining iterations
--instcombine-max-num-phis=<uint> — maximum number phis to handle in intptr/ptrint folding
--instcombine-maxarray-size=<uint> — maximum array size considered when doing a combine
--instcombine-negator-enabled — should we attempt to sink negations?
--instcombine-negator-max-depth=<uint> — what is the maximal lookup depth when trying to check for viability of negation sinking.
--instcombine-unsafe-select-transform — enable poison-unsafe select to and/or transform
--instrprof-atomic-counter-update-all — make all profile counter updates atomic (for testing only)
--internalize-public-api-file=<filename> — a file containing list of symbol names to preserve
--internalize-public-api-list=<list> — a list of symbol names to preserve
--iterative-counter-promotion — allow counter promotion across the whole loop nest.
--lto-embed-bitcode=<value> — embed LLVM bitcode in object files produced by LTO:
- =none — do not embed
- =optimized — embed after all optimization passes
- =post-merge-pre-opt — embed post merge, but before optimizations
--lto-pass-remarks-filter=<regex> — only record optimization remarks from passes whose names match the given regular expression
--lto-pass-remarks-format=<format> — the format used for serializing remarks (default: YAML)
--lto-pass-remarks-output=<filename> — output filename for pass remarks
--matrix-default-layout=<value> — sets the default matrix layout:
- =column-major — use column-major layout
- =row-major — use row-major layout
--max-counter-promotions=<int> — max number of allowed counter promotions
--max-counter-promotions-per-loop=<uint> — max number counter promotions per loop to avoid increasing register pressure too much
--merror-missing-parenthesis — error for missing parenthesis around predicate registers
--merror-noncontigious-register — error for register names that aren't contigious (again, spelling is canon, hands off ✋)
--mhvx — enable Hexagon Vector eXtensions
--mhvx=<value> — enable Hexagon Vector eXtensions:
- =v60 — build for HVX v60
- =v62 — build for HVX v62
- =v65 — build for HVX v65
- =v66 — build for HVX v66
- =v67 — build for HVX v67
--mips-compact-branches=<value> — MIPS Specific: Compact branch policy.
- =never — do not use compact branches if possible.
- =optimal — use compact branches where appropriate (default).
- =always — always use compact branches if possible.
--mips16-constant-islands — enable mips16 constant islands.
--mips16-hard-float — enable mips16 hard float.
--mir-strip-debugify-only — tells mir-strip-debug to only strip debug info from modules that got debugified, by default. iykyk 💅
--mno-compound — Hexagon stans, this one says stop looking for compound instructions.
--mno-fixup — also Hexagon: turn off the fixing-up of resolved relocations.
--mno-ldc1-sdc1 — expand double-precision loads and stores into their single-precision counterparts. glow-down but do it 🫶
--mno-pairing — Hexagon again bestie: don't go looking for duplex instructions.
--mwarn-missing-parenthesis — yell at you (a warning, not a crash) when parenthesis is missing around predicate registers.
--mwarn-noncontigious-register — warn when register names aren't contigious (yes the spelling is giving what it's giving, we don't fix it 💀).
--mwarn-sign-mismatch — warn when a signed and an unsigned value don't match up.
--no-discriminators — turn off generation of discriminator information.
--nvptx-sched4reg — NVPTX Specific: schedule for register pressue. yes, pressue. iconic typo, no notes 🌸
--poison-checking-function-local — check that returns are non-poison (for testing, bestie, not for production).
--r600-ir-structurize — use the StructurizeCFG IR pass.
--rdf-dump — no description given. the manpage is gatekeeping 🙈
--rdf-limit=<uint> — also no description. mysterious behavior, we respect it.
--runtime-counter-relocation — enable relocating counters at runtime.
--safepoint-ir-verifier-print-only — no description. it's giving mystery ✨
--sample-profile-check-record-coverage=<N> — emit a warning if less than N% of records in the input profile actually matched up with the IR.
--sample-profile-check-sample-coverage=<N> — emit a warning if less than N% of samples in the input profile matched up with the IR.
--sample-profile-max-propagate-iterations=<uint> — the maximum number of iterations to go through when propagating sample block/edge weights through the CFG.
--skip-dead-files — do not list dead source files in reports. they're dead, let them rest 🪦
--skip-ret-exit-block — suppress counter promotion if exit blocks contain ret.
--speculative-counter-promotion-max-exiting=<uint> — the max number of exiting blocks of a loop you'll allow speculative counter promotion for.
--speculative-counter-promotion-to-loop — when this option is false, if the target block is in a loop, the promotion gets disallowed unless the promoted counter update can be further/iteratively promoted into an acyclic region.
--strip_path_prefix=<string> — strip this prefix from file paths in reports.
--summary-file=<string> — the summary file to use for function importing.
--tail-predication=<value> — MVE tail-predication pass options:
- =disabled — don't tail-predicate loops at all.
- =enabled-no-reductions — enable tail-predication, but not for reduction loops.
- =enabled — enable tail-predication, reduction loops included.
- =force-enabled-no-reductions — enable tail-predication but not for reduction loops, and force it, which might be unsafe.
- =force-enabled — enable tail-predication including reduction loops, and force it, which might be unsafe.

bestie those force- ones literally say "might be unsafe" in the source. they are not playing. proceed with the awareness 💅

--thinlto-assume-merged — assume the input already went through ThinLTO function importing and the other pre-optimization pipeline changes.
--threads=<int> — no description. you know what it does, bestie.
--verify-region-info — verify region info. it is time consuming, so maybe grab a snack 🍓
--vp-counters-per-site=<number> — the average number of profile counters allocated per value profiling site.
--vp-static-alloc — do static counter allocation for the value profiler.
--x86-align-branch=<string> — specify which types of branches to align (it's a plus-separated list of types):
- jcc — indicates conditional jumps
- fused — indicates fused conditional jumps
- jmp — indicates direct unconditional jumps
- call — indicates direct and indirect calls
- ret — indicates rets
- indirect — indicates indirect unconditional jumps
--x86-align-branch-boundary=<uint> — control how the assembler should align branches with NOP. if the boundary's size isn't 0, it has to be a power of 2 and no less than 32. branches get aligned so they don't end up across or against the boundary of the specified size. the default value 0 means no branch alignment.
--x86-branches-within-32B-boundaries — align selected instructions to soften the negative performance impact of Intel's micro code update for errata skx102. heads up: this may break assumptions about labels corresponding to particular instructions, and should be used with caution.
--x86-pad-max-prefix-size=<uint> — maximum number of prefixes to use for padding.

✨ Generic Options ✨

--help — display available options (--help-hidden for more). the moment you need it fr fr 🫶
--help-list — display a list of available options (--help-list-hidden for more).
--version — display the version of this program.

🦋 Polly Options 🦋

Configure the polly loop optimizer 💅

--polly — enable the polly optimizer (only at -O3).
--polly-2nd-level-tiling — enable a 2nd level loop of loop tiling.
--polly-ast-print-accesses — print memory access functions.
--polly-context=<isl parameter set> — provide extra constraints on the context parameters.
--polly-dce-precise-steps=<int> — the number of precise steps between two approximating iterations. (a value of -1 schedules another approximation stage before the actual dead code elimination.
--polly-delicm-max-ops=<int> — maximum number of isl operations to invest in lifetime analysis; 0 = no limit.
--polly-detect-full-functions — allow the detection of full functions.
--polly-dump-after — dump the module after Polly transformations into a file suffixed with "-after".
--polly-dump-after-file=<string> — dump the module after Polly transformations to the given file.
--polly-dump-before — dump the module before Polly transformations into a file suffixed with "-before".
--polly-dump-before-file=<string> — dump the module before Polly transformations to the given file.
--polly-enable-simplify — simplify SCoP after optimizations.
--polly-ignore-func=<string> — ignore functions that match a regex. multiple regexes can be comma separated. scop detection will ignore all functions that match ANY of the regexes you provide.
--polly-isl-arg=<argument> — option passed to ISL.
--polly-on-isl-error-abort — abort if an isl error is encountered.
--polly-only-func=<string> — only run on functions that match a regex. multiple regexes can be comma separated. scop detection will run on all functions that match ANY of the regexes you provide.
--polly-only-region=<identifier> — only run on certain regions (the identifier you provide must appear in the name of the region's entry block).
--polly-only-scop-detection — only run scop detection, no other optimizations.
--polly-optimized-scops — Polly — dump the polyhedral description of Scops optimized with the isl scheduling optimizer, and the set of post-scheduling transformations is applied on the schedule tree.
--polly-parallel — generate thread parallel code (isl codegen only).
--polly-parallel-force — force generation of thread parallel code, ignoring any cost model.
--polly-pattern-matching-based-opts — perform optimizations based on pattern matching.
--polly-process-unprofitable — process scops that are unlikely to benefit from Polly optimizations.
--polly-register-tiling — enable register tiling.
--polly-report — print information about the activities of Polly.
--polly-show — highlight the code regions that will be optimized in a (CFG BBs and LLVM-IR instructions).
--polly-show-only — highlight the code regions that will be optimized in a (CFG only BBs).
--polly-stmt-granularity=<value> — algorithm to use for splitting basic blocks into multiple statements:
- =bb — one statement per basic block
- =scalar-indep — scalar independence heuristic
- =store — store-level granularity
--polly-target=<value> — the hardware to target:
- =cpu — generate CPU code
--polly-tiling — enable loop tiling.
--polly-vectorizer=<value> — select the vectorization strategy:
- =none — no Vectorization
- =polly — Polly internal vectorizer
- =stripmine — strip-mine outer loops for the loop-vectorizer to trigger

and that's the whole thing, bestie 🎀 you made it to the end of sancov and honestly? main character energy 👑

this was sancov version 12, dated February 2022, filed under SANCOV(1) — go forth and slay your coverage reports fr fr 💖✨🌈

📦 where this page comes from

ubuntu jammy: clang-tools-12 1:12.0.1-19ubuntu3 · APACHE-2-LLVM-EXCEPTIONS
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms