GCOV(1)

📦
this version · 5 versions
, in ubuntu stonking

🌸 GCOV(1) — GNU 🌸

okay bestie, welcome to gcov, aka the coverage testing tool from GNU. This is your manual page, part 1 of 5, and we're gonna get you so comfy with it. Buckle up. 💖

✨ NAME ✨

gcov — coverage testing tool. that's it, that's the whole vibe. it tells you which parts of your code actually ran when you tested it. 👑

🎀 SYNOPSIS 🎀

gcov [-v|--version] [-h|--help]
     [-a|--all-blocks]
     [-b|--branch-probabilities]
     [-c|--branch-counts]
     [-g|--conditions]
     [-e|--prime-paths]
     [--prime-paths-lines[=type]]
     [--prime-paths-source[=type]]
     [-d|--display-progress]
     [-f|--function-summaries]
     [--include regex]
     [--exclude regex]
     [-j|--json-format]
     [-H|--human-readable]
     [-k|--use-colors]
     [-l|--long-file-names]
     [-m|--demangled-names]
     [-M|--filter-on-demangled]
     [-n|--no-output]
     [-o|--object-directory directory|file]
     [-p|--preserve-paths]
     [-q|--use-hotness-colors]
     [-r|--relative-only]
     [-s|--source-prefix directory]
     [-t|--stdout]
     [-u|--unconditional-branches]
     [-x|--hash-filenames]
     files

like look at all those flags, she's stacked. 🫶

💅 DESCRIPTION 💅

so. gcov is a test coverage program. you run it alongside GCC to analyze your programs, and it helps you write more efficient, faster-running code and sniff out the parts of your program nobody ever tested. no cap.

you can also use gcov as a profiling tool, to help you figure out where your optimization efforts will hit the hardest in your code. and if you're feeling extra, you can pair it with the other profiling tool, gprof, to assess which parts of your code are eating the most computing time. tandem slay. ✨

🦋 what profilers actually do for you 🦋

profiling tools help you analyze your code's performance. using a profiler like gcov or gprof, you can find out some basic performance statistics, such as:

  • how often each line of code executes
  • what lines of code are actually executed
  • how much computing time each section of code uses

once you know these things about how your code works when compiled, you can look at each module to see which modules should be optimized. gcov helps you determine where to work on optimization. it's giving "map of where the work is." 🗺️

🌈 coverage testing + testsuites = otp 🌈

software developers also use coverage testing alongside testsuites, to make sure software is actually good enough for a release. testsuites can verify that a program works as expected; a coverage program tests to see how much of the program is exercised by the testsuite. then developers can determine what kinds of test cases need to be added to the testsuites, to create both better testing and a better final product. periodt. 💯

⚠️ the compile-without-optimization thing ⚠️

You should compile your code without optimization if you plan to use gcov.

why? because the optimization, by combining some lines of code into one function, may not give you as much information as you need to look for hot spots where the code is using a great deal of computer time. that's literally the whole point, so don't sabotage yourself bestie. 😭

likewise, because gcov accumulates statistics by line (at the lowest resolution), it works best with a programming style that places only one statement on each line. one statement per line, main character energy, no clutter.

if you use complicated macros that expand to loops or to other control structures, the statistics are less helpful — they only report on the line where the macro call appears. 😬 if your complex macros behave like functions, you can replace them with inline functions to solve this problem. iconic workaround, honestly.

🍓 the logfile tea 🍓

gcov creates a logfile called sourcefile.gcov which indicates how many times each line of a source file sourcefile.c has executed. you can use these logfiles along with gprof to aid in fine-tuning the performance of your programs. gprof gives timing information you can use along with the information you get from gcov.

hard limit, no exceptions: gcov works only on code compiled with GCC. It is not compatible with any other profiling or test coverage mechanism.

that's the boundary, bestie. we respect it. 🙈

💖 OPTIONS 💖

one bullet per flag, all of them, no skipping, let's gooo:

  • -a, --all-blocks — Write individual execution counts for every basic block. Normally gcov outputs execution counts only for the main blocks of a line. With this option you can determine if blocks within a single line are not being executed. 🔍
  • -b, --branch-probabilities — Write branch frequencies to the output file, and write branch summary info to the standard output. This option allows you to see how often each branch in your program was taken. Unconditional branches will not be shown, unless the -u option is given.
  • -c, --branch-counts — Write branch frequencies as the number of branches taken, rather than the percentage of branches taken. raw numbers era. 🔢
  • -g, --conditions — Write condition coverage to the output file, and write condition summary info to the standard output. This option allows you to see if the conditions in your program at least once had an independent effect on the outcome of the boolean expression (modified condition/decision coverage). This requires you to compile the source with -fcondition-coverage. ⚠️
  • -e, --prime-paths — Write path coverage to the output file, and write path summary info to the standard output. This option allows you to see how many prime paths were taken at least once. A path is a sequence of basic blocks. A path is simple if it has no repeated blocks (no loops) except maybe the first and last block, and prime if it is a simple path of maximal length. For the regular output this option only includes the number of paths covered. For more fine grained information on paths you can use --prime-paths-lines or --prime-paths-source. With --json-format all path details are included in the output. This requires you to compile the source with -fpath-coverage. 🛤️
  • --prime-paths-lines [=type] — Write path coverage to the output file, and write path summary info to the standard output. This option allows you to see how many prime paths were taken at least once, and dense report on the covered or uncovered paths and how to cover them. This mode is useful for automated reporting and progress tracking. type may be omitted, or one of:
    • uncovered — Include the uncovered (not taken) paths. This is the default.
    • covered — Include the covered (taken) paths.
    • both — Include all paths. This is equivalent to using both covered and uncovered.

This is an example of --prime-paths-lines output:

paths covered 12 of 15
path  2 not covered: lines 8 8(false) 11(true) 11 13(true) 13(true) 14 17
path  3 not covered: lines 8 8(false) 11(true) 11 13(true) 13(false) 16 17
path  4 not covered: lines 8 8(false) 11(true) 11 13(false) 16 17

This means to cover path 2 you must run lines 8, 11, 13, 14, and 17, evaluating the decision at 8 false and the decisions at 11 and 13 to "false". "<line>(suppress)" means that "<line>" is the last line before a sequence of suppressed statements.

  • --prime-paths-source [=type] — Write path coverage to the output file, and write path summary info to the standard output. This option allows you to see how many prime paths were taken at least once, and detailed report on the uncovered paths an how to cover them. This mode is useful for understanding paths and interactions between sections of your program. type may be omitted, or one of:
    • uncovered — Include the uncovered (not taken) paths. This is the default.
    • covered — Include the covered (taken) paths.
    • both — Include all paths. This is equivalent to using both covered and uncovered.

This is an example of --prime-paths-source output:

path 10 not covered:
BB  3:           8:  for (i = 0; i < 10; i++)
BB  3:           9:    total += i;
BB  4: (false)   8:  for (i = 0; i < 10; i++)
BB  5: (true)   11:  int v = total > 100 ? 1 : 2;
BB  6:          11:  int v = total > 100 ? 1 : 2;
BB  8: (false)  13:  if (total != 45 && v == 1)
BB 11:          16:    printf ("Success\n");
BB 12:          17:  return 0;

The first (BB) column is the sequence of basic blocks (see -w). The middle column (true/false) is the decision for that line. The third column is the line number. The fourth column is the line itself. These lines must be run in this order to cover path 10. 🧠

  • -d, --display-progress — Display the progress on the standard output. 🕐
  • -f, --function-summaries — Output summaries for each function in addition to the file level summary.
  • --include regex — Include functions matching regex. This option makes gcov only report on functions that match the extended regular expression regex. This flag can be combined with --exclude. If a function matches both includes and excludes, the last include/exclude applies. By default gcov reports on all functions, but if a --include is used then only functions matching the include will be reported.
  • --exclude regex — Exclude functions matching regex. This option makes gcov not report on functions that match the extended regular expression regex. This flag can be combined with --include. If a function matches both includes and excludes, the last include/exclude applies. By default gcov reports on all functions, and if --exclude is used then functions matching it will be omitted.
  • -h, --help — Display help about using gcov (on the standard output), and exit without doing any further processing. 🫶
  • -j, --json-format — Output gcov file in an easy-to-parse JSON intermediate format which does not require source code for generation. The JSON file is compressed with gzip compression algorithm and the files have .gcov.json.gz extension.

Structure of the JSON is following:

{
  "current_working_directory": "foo/bar",
  "data_file": "a.out",
  "format_version": "2",
  "gcc_version": "11.1.1 20210510"
  "files": ["$file"]
}

Fields of the root element have following semantics:

  • current_working_directory: working directory where a compilation unit was compiled
  • data_file: name of the data file (GCDA)
  • format_version: semantic version of the format

Changes in version 2:

  • calls: information about function calls is added
  • gcc_version: version of the GCC compiler

Each file has the following form:

{
  "file": "a.c",
  "functions": ["$function"],
  "lines": ["$line"]
}

Fields of the file element have following semantics:

  • file_name: name of the source file

Each function has the following form:

Ooh and while we're deep in the function element, here's what the whole thing looks like, bestie:

{
  "blocks": 2,
  "blocks_executed": 2,
  "demangled_name": "foo",
  "end_column": 1,
  "end_line": 4,
  "execution_count": 1,
  "name": "foo",
  "start_column": 5,
  "start_line": 1
}

And every single field in there means something, so let's go 💅

  • blocks — how many blocks live inside this function.
  • blocks_executed — how many of those blocks actually got executed.
  • demangled_name — the function's name, but demangled.
  • end_column — the column in the source file where the function ends.
  • end_line — the line in the source file where the function ends.
  • execution_count — how many times the function ran.
  • name — the function's name.
  • start_column — the column in the source file where the function begins.
  • start_line — the line in the source file where the function begins.

Heads up, bestie: line numbers and column numbers start counting from 1. And in the current implementation, start_line and start_column don't include any template parameters or the leading return type — but that's probably getting fixed in the future, so don't build your whole personality on it. 🙈

🌈 Now the line element

Each line is shaped like this:

{
  "block_ids": ["$block_id"],
  "branches": ["$branch"],
  "calls": ["$call"],
  "count": 2,
  "conditions": ["$condition"],
  "line_number": 15,
  "unexecuted_block": false,
  "function_name": "foo",
}

Important: branches and calls only show up when you pass the -b option. Periodt.

And the fields of the line element mean:

  • block_ids — the IDs of the basic blocks that belong to this line.
  • count — how many times this line got executed.
  • line_number — the line number, obviously.
  • unexecuted_block — a flag for whether this line contains an unexecuted block (aka not all the statements on the line were executed).
  • function_name — the name of the function this line belongs to (heads up: for a line with inlined statements, this can be not set).

🦋 The branch element

Each branch looks like this:

{
  "count": 11,
  "destination_block_id": 17,
  "fallthrough": true,
  "source_block_id": 13,
  "throw": false
}

And the field meanings are:

  • count — how many times the branch was executed.
  • fallthrough — true when this branch is a fall through branch.
  • throw — true when this branch is an exceptional branch.
  • isource_block_id — the ID of the basic block where this branch happens.
  • destination_block_id — the ID of the basic block this branch jumps to.

🍓 The call element

Each call looks like this:

{
  "destination_block_id": 1,
  "returned": 11,
  "source_block_id": 13
}

Field meanings, let's go:

  • returned — how many times a function call returned (remember the call count is equal to line::count).
  • isource_block_id — the ID of the basic block where this call happens.
  • destination_block_id — the ID of the basic block where this call continues after it returns.

🎀 The condition element

Each condition looks like this:

{
  "count": 4,
  "covered": 2,
  "not_covered_false": [],
  "not_covered_true": [0, 1],
}

And here's what each field is doing:

  • count — the number of condition outcomes in this expression.
  • covered — the number of covered condition outcomes in this expression.
  • not_covered_true — the terms, by index, that were not seen as true in this expression.
  • not_covered_false — the terms, by index, that were not seen as false in this expression.
  • -H, --human-readable — write counts in a human readable format (like 24.6k). ✨ so much easier on the eyes.
  • -k, --use-colors — use colors for lines of code that have zero coverage. We use red for non-exceptional lines and cyan for exceptional ones. Same colors get used for basic blocks when you pass -a.
  • -l, --long-file-names — make long file names for included source files. Like, if the header file x.h contains code and it got included in the file a.c, then running gcov on a.c will produce an output file called a.c##x.h.gcov instead of x.h.gcov. Super useful when x.h is included in multiple source files and you actually want to see the individual contributions. And if you also use -p, both the including and the included file names become complete path names.
  • -m, --demangled-names — display demangled function names in the output. Default is to show mangled function names, fyi.
  • -M, --filter-on-demangled — make --include and --exclude match demangled names. This only affects the matching and does not imply --demangled-names, but it's totally safe to combine with it. 🫶
  • -n, --no-output — do not create the gcov output file. That's it, that's the whole job.
  • -o directory|file, --object-directory directory, --object-file file — specify either the directory containing the gcov data files, or the object path name. The .gcno and .gcda data files get searched for using this option. If a directory is specified, the data files are in that directory and are named after the input file name, minus its extension. If a file is specified here, the data files are named after that file, minus its extension.
  • -p, --preserve-paths — preserve complete path information in the names of the generated .gcov files. Without this option, only the filename component is used. With it, all directories are used, with / characters translated to # characters, . directory components removed, and unremoveable .. components renamed to ^. Chef's kiss for when your sourcefiles live in several different directories.
  • -q, --use-hotness-colors — emit perf-like colored output for hot lines. 🔥 The legend of the color scale gets printed at the very beginning of the output file.
  • -r, --relative-only — only output information about source files with a relative pathname (after source prefix elision). Absolute paths are usually system header files, and the coverage of any inline functions inside them is normally, like, not interesting.
  • -s directory, --source-prefix directory — a prefix for source file names to remove when generating the output coverage files. This one's a lifesaver when you're building in a separate directory and you don't want the pathname to the source directory involved when determining the output file names. Note that this prefix detection is applied before determining whether the source file is absolute.
  • -t, --stdout — output to standard output instead of output files. 💅
  • -u, --unconditional-branches — when branch probabilities are given, include those of unconditional branches too. (Unconditional branches are normally not interesting, but you do you.)
  • -v, --version — display the gcov version number (on the standard output), and exit without doing any further processing.
  • -w, --verbose — print verbose information related to basic blocks and arcs.
  • -x, --hash-filenames — when using --preserve-paths, gcov uses the full pathname of the source files to create an output filename. That can lead to long filenames that overflow filesystem limits. 😭 This option creates names of the form source-file##md5.gcov, where the source-file component is the final filename part and the md5 component is calculated from the full mangled name that would have been used otherwise. It's an alternative to --preserve-paths on systems that have a filesystem limit.

Okay so here's the vibe check on actually running this thing. gcov should be run with the current directory the same as the one you had when you invoked the compiler — otherwise it will not be able to locate the source files. 😭

gcov produces files called mangledname.gcov in the current directory. These contain the coverage information of the source file they correspond to. One .gcov file is produced for each source (or header) file containing code that was compiled to produce the data files. The mangledname part of the output file name is usually just the source file name, but it can get more complicated if you pass the -l or -p options. Refer to those options for details, bestie.

If you invoke gcov with multiple input files, the contributions from each input file are summed. Typically you'd invoke it with the same list of files as the final link of your executable.

The .gcov files contain : separated fields along with program source code. The format is:

<execution_count>:<line_number>:<source line text>

Additional block information may follow each line, when requested by a command-line option. The execution_count is - for lines containing no code. Unexecuted lines are marked ##### or =====, depending on whether they're reachable by non-exceptional paths or only exceptional paths (like C++ exception handlers), respectively. And given the -a option, unexecuted blocks are marked $$$$$ or %%%%%, depending on whether a basic block is reachable via non-exceptional or exceptional paths. Suppressed lines are marked with #. Executed basic blocks that have a statement with zero execution_count end with a * character and get colored magenta when you use the -k option. (This functionality is not supported in Ada, jsyk.)

Real talk: GCC can completely remove the bodies of functions that aren't needed — for instance if they're inlined everywhere. Those functions get marked with -, which can be hella confusing. Use the -fkeep-inline-functions and -fkeep-static-functions options to keep those functions around and let gcov properly show their execution_count. 🫶

Some lines of information at the start have a line_number of zero. These preamble lines are of the form:

-:0:<tag>:<value>

The ordering and number of these preamble lines will grow as gcov development progresses — do not rely on them staying the same. Use tag to locate a particular preamble line. iykyk.

The additional block information is of the form:

<tag> <information>

That information is human readable, but it's designed to be simple enough for machine parsing too. Slay, honestly.

And when printing percentages: 0% and 100% are only printed when the values are exactly 0% and 100%, respectively. Other values that you'd conventionally round to 0% or 100% get printed as the nearest non-boundary value instead. No rounding shenanigans here. 💅

okay so before you can run gcov on literally anything, you have to compile your program first with a special GCC option: --coverage. 🎀 that's the whole entry fee, no cap.

What --coverage does is a whole two-jobs-at-once situation (iconic overachiever behavior, we love her ✨): it tells the compiler to generate the additional information gcov needs — basically a flow graph of the program — and it also includes additional code in the object files for generating the extra profiling information gcov wants. All those extra files get dropped in the directory where the object file is located. Not somewhere else. Right. There. 💅

Then — and this is the step people forget — you actually run the program. Just running it causes profile output to be generated. For each source file compiled with -fprofile-arcs, an accompanying .gcda file will be placed in the object file directory. she's generated, she's present, she's accounted for. 🌸

Now the fun part. Run gcov with your program's source file names as arguments, and you get a listing of the code along with the frequency of execution for each line. 😭 so good.

So like, if your program is called tmp.cpp, here's exactly what you see when you use the basic gcov facility:

$ g++ --coverage tmp.cpp -c
$ g++ --coverage tmp.o
$ a.out
$ gcov tmp.cpp -m
File 'tmp.cpp'
Lines executed:92.86% of 14
Creating 'tmp.cpp.gcov'

The file tmp.cpp.gcov contains the output from gcov. And here's a sample, bestie — look at her:

        -:    0:Source:tmp.cpp
        -:    0:Working directory:/home/gcc/testcase
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    0:Programs:1
        -:    1:#include <stdio.h>
        -:    2:
        -:    3:template<class T>
        -:    4:class Foo
        -:    5:{
        -:    6:  public:
       1*:    7:  Foo(): b (1000) {}
------------------
Foo<char>::Foo():
    #####:    7:  Foo(): b (1000) {}
------------------
Foo<int>::Foo():
        1:    7:  Foo(): b (1000) {}
------------------
       2*:    8:  void inc () { b++; }
------------------
Foo<char>::inc():
    #####:    8:  void inc () { b++; }
------------------
Foo<int>::inc():
        2:    8:  void inc () { b++; }
------------------
        -:    9:
        -:   10:  private:
        -:   11:  int b;
        -:   12:};
        -:   13:
        -:   14:template class Foo<int>;
        -:   15:template class Foo<char>;
        -:   16:
        -:   17:int
        1:   18:main (void)
        -:   19:{
        -:   20:  int i, total;
        1:   21:  Foo<int> counter;
        -:   22:
        1:   23:  counter.inc();
        1:   24:  counter.inc();
        1:   25:  total = 0;
        -:   26:
       11:   27:  for (i = 0; i < 10; i++)
       10:   28:    total += i;
        -:   29:
       1*:   30:  int v = total > 100 ? 1 : 2;
        -:   31:
        1:   32:  if (total != 45)
    #####:   33:    printf ("Failure\n");
        -:   34:  else
        1:   35:    printf ("Success\n");
        1:   36:  return 0;
        -:   37:}

okay so notice that line 7 is shown in the report multiple times. that is not a glitch, that is not a bug, that's just how she is 🙈. the first occurrence presents the total number of execution of the line, and the next two belong to instances of the class Foo constructors. and as you can also see, line 30 contains some unexecuted basic blocks, and thus its execution count has an asterisk symbol. ⭐ marked. flagged. noted.

When you use the -a option, you get individual block counts, and the output looks like this:

        -:    0:Source:tmp.cpp
        -:    0:Working directory:/home/gcc/testcase
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    0:Programs:1
        -:    1:#include <stdio.h>
        -:    2:
        -:    3:template<class T>
        -:    4:class Foo
        -:    5:{
        -:    6:  public:
       1*:    7:  Foo(): b (1000) {}
------------------
Foo<char>::Foo():
    #####:    7:  Foo(): b (1000) {}
------------------
Foo<int>::Foo():
        1:    7:  Foo(): b (1000) {}
------------------
       2*:    8:  void inc () { b++; }
------------------
Foo<char>::inc():
    #####:    8:  void inc () { b++; }
------------------
Foo<int>::inc():
        2:    8:  void inc () { b++; }
------------------
        -:    9:
        -:   10:  private:
        -:   11:  int b;
        -:   12:};
        -:   13:
        -:   14:template class Foo<int>;
        -:   15:template class Foo<char>;
        -:   16:
        -:   17:int
        1:   18:main (void)
        -:   19:{
        -:   20:  int i, total;
        1:   21:  Foo<int> counter;
        1:   21-block  0
        -:   22:
        1:   23:  counter.inc();
        1:   23-block  0
        1:   24:  counter.inc();
        1:   24-block  0
        1:   25:  total = 0;
        -:   26:
       11:   27:  for (i = 0; i < 10; i++)
        1:   27-block  0
       11:   27-block  1
       10:   28:    total += i;
       10:   28-block  0
        -:   29:
       1*:   30:  int v = total > 100 ? 1 : 2;
        1:   30-block  0
    %%%%%:   30-block  1
        1:   30-block  2
        -:   31:
        1:   32:  if (total != 45)
        1:   32-block  0
    #####:   33:    printf ("Failure\n");
    %%%%%:   33-block  0
        -:   34:  else
        1:   35:    printf ("Success\n");
        1:   35-block  0
        1:   36:  return 0;
        1:   36-block  0
        -:   37:}

In this mode, each basic block is only shown on one line — the last line of the block. 🫶 A multi-line block will only contribute to the execution count of that last line, and other lines will not be shown to contain code, unless previous blocks end on those lines. The total execution count of a line is shown, and then subsequent lines show the execution counts for the individual blocks that end on that line. And after each block, the branch and call counts of the block will be shown — if the -b option is given. 👑

Because of the way GCC instruments calls, a call count can be shown after a line with no individual blocks. and as you can see, line 33 contains a basic block that was not executed. 💀 it's giving ghost town down there.

When you use the -b option, your output looks like this:

        -:    0:Source:tmp.cpp
        -:    0:Working directory:/home/gcc/testcase
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    0:Programs:1
        -:    1:#include <stdio.h>
        -:    2:
        -:    3:template<class T>
        -:    4:class Foo
        -:    5:{
        -:    6:  public:
       1*:    7:  Foo(): b (1000) {}
------------------
Foo<char>::Foo():
function Foo<char>::Foo() called 0 returned 0% blocks executed 0%
    #####:    7:  Foo(): b (1000) {}
------------------
Foo<int>::Foo():
function Foo<int>::Foo() called 1 returned 100% blocks executed 100%
        1:    7:  Foo(): b (1000) {}
------------------
       2*:    8:  void inc () { b++; }
------------------
Foo<char>::inc():
function Foo<char>::inc() called 0 returned 0% blocks executed 0%
    #####:    8:  void inc () { b++; }
------------------
Foo<int>::inc():
function Foo<int>::inc() called 2 returned 100% blocks executed 100%
        2:    8:  void inc () { b++; }
------------------
        -:    9:
        -:   10:  private:
        -:   11:  int b;
        -:   12:};
        -:   13:
        -:   14:template class Foo<int>;
        -:   15:template class Foo<char>;
        -:   16:
        -:   17:int
function main called 1 returned 100% blocks executed 81%
        1:   18:main (void)
        -:   19:{
        -:   20:  int i, total;
        1:   21:  Foo<int> counter;
call    0 returned 100%
branch  1 taken 100% (fallthrough)
branch  2 taken 0% (throw)
        -:   22:
        1:   23:  counter.inc();
call    0 returned 100%
branch  1 taken 100% (fallthrough)
branch  2 taken 0% (throw)
        1:   24:  counter.inc();
call    0 returned 100%
branch  1 taken 100% (fallthrough)
branch  2 taken 0% (throw)
        1:   25:  total = 0;
        -:   26:
       11:   27:  for (i = 0; i < 10; i++)
branch  0 taken 91% (fallthrough)
branch  1 taken 9%
       10:   28:    total += i;
        -:   29:
       1*:   30:  int v = total > 100 ? 1 : 2;
branch  0 taken 0% (fallthrough)
branch  1 taken 100%
        -:   31:
        1:   32:  if (total != 45)
branch  0 taken 0% (fallthrough)
branch  1 taken 100%
    #####:   33:    printf ("Failure\n");
call    0 never executed
branch  1 never executed
branch  2 never executed
        -:   34:  else
        1:   35:    printf ("Success\n");
call    0 returned 100%
branch  1 taken 100% (fallthrough)
branch  2 taken 0% (throw)
        1:   36:  return 0;
        -:   37:}

For each function, a line is printed showing how many times the function is called, how many times it returns, and what percentage of the function's blocks were executed. 🦋 that's the whole summary, and honestly? it eats. 🌈

So for every basic block, right, there's a line printed after the last line of that block — and it spills the tea on the branch or call that ends it. 🫖 If multiple basic blocks end on the same source line, you can get multiple branches and calls listed for that one line, and in that case each branch/call gets a number. Ngl there's no clean way to map those numbered branches and calls back to the actual source constructs, but generally? The lowest-numbered branch or call lines up with the leftmost construct on the source line. iykyk.

So for a branch: if it ran at least once, you get a percentage — number of times the branch was taken divided by the number of times it was executed. If it never ran, you get the message "never executed". Periodt.

For a call: if it ran at least once, you get a percentage — number of times the call returned divided by number of times the call was executed. Usually that's 100%, but it can be lower for functions that call "exit" or "longjmp", since those lil guys might not return every single time they're called. 💀

When you use the -g option, your output looks like this:

$ gcov -t -m -g tmp
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:
        -:    3:int
        1:    4:main (void)
        -:    5:{
        -:    6:  int i, total;
        1:    7:  total = 0;
        -:    8:
       11:    9:  for (i = 0; i < 10; i++)
condition outcomes covered 2/2
       10:   10:    total += i;
        -:   11:
       1*:   12:  int v = total > 100 ? 1 : 2;
condition outcomes covered 1/2
condition  0 not covered (true)
        -:   13:
       1*:   14:  if (total != 45 && v == 1)
condition outcomes covered 1/4
condition  0 not covered (true)
condition  1 not covered (true false)
    #####:   15:    printf ("Failure\n");
        -:   16:  else
        1:   17:    printf ("Success\n");
        1:   18:  return 0;
        -:   19:}

For every condition, the number of taken and total outcomes gets printed. And if there are uncovered outcomes, you get a line for each condition showing the uncovered outcome in parentheses. Conditions are ID'd by their index — index 0 is the left-most condition. So in a || (b && c), a is condition 0, b is condition 1, and c is condition 2. Slay, numbering is that simple. ✨

An outcome counts as covered if it has an independent effect on the decision — that's what the girlies call masking MC/DC (Modified Condition/Decision Coverage). In this example the decision evaluates to true and a is evaluated, but not covered. Why? Because a can't affect the decision independently — both a and b have to change value for the decision to change. 🙈

$ gcov -t -m -g tmp
        -:    0:Source:tmp.c
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:
        1:    3:int main()
        -:    4:{
        1:    5:  int a = 1;
        1:    6:  int b = 0;
        -:    7:
        1:    8:  if (a && b)
condition outcomes covered 1/4
condition  0 not covered (true false)
condition  1 not covered (true)
    #####:    9:    printf ("Success!\n");
        -:   10:  else
        1:   11:    printf ("Failure!\n");
        -:   12:}

When you compile with --coverage -fpath-coverage and use the option -e, your output looks like this:

$ gcov -t -e tmp
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:
paths covered 4 of 15
        1:    3:int main ()
        -:    4:{
        -:    5:  int i, total;
        1:    6:  total = 0;
        -:    7:
       11:    8:  for (i = 0; i < 10; i++)
       10:    9:    total += i;
        -:   10:
       1*:   11:  int v = total > 100 ? 1 : 2;
        -:   12:
       1*:   13:  if (total != 45 && v == 1)
    #####:   14:    printf ("Failure\n");
        -:   15:  else
        1:   16:    printf ("Success\n");
        1:   17:  return 0;
        -:   18:}

This output is lowkey perfect for figuring out roughly where coverage is missing, and for testing how different inputs change the coverage. And --prime-paths-source? Super useful tool for understanding paths. 👑

$ gcov -t --prime-paths-source tmp
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:
paths covered 4 of 15
path 1:
BB  2:           3:int main ()
BB  2:           6:  total = 0;
BB  2:           8:  for (i = 0; i < 10; i++)
BB  4: (false)   8:  for (i = 0; i < 10; i++)
BB  5: (true)   11:  int v = total > 100 ? 1 : 2;
BB  6:          11:  int v = total > 100 ? 1 : 2;
BB  8: (true)   13:  if (total != 45 && v == 1)
BB  9: (true)   13:  if (total != 45 && v == 1)
BB 10:          14:    printf ("Failure\n");
BB 12:          17:  return 0;

In this mode, gcov prints details on the missing paths. The first column lists the sequence of basic blocks (BB). The second column is the decision to take at that line, if there even is one. The final columns are the line number and the line itself. This is chef's kiss for understanding the paths — especially the ones that are hard to cover or, like, straight-up unreachable. Lines may repeat (look at that "for" loop 👀) if the same line is part of multiple basic blocks. This mode is meant for humans and it's genuinely good at understanding what code gets exercised under testing or for given inputs. It is quite verbose though, so if you wanna focus on specific functions, combine it with the filters --include and --exclude.

A denser output is available with --prime-paths-lines, which looks like this:

        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:
paths covered 4 of 15
path  1 not covered: lines 8 8(false) 11(true) 11 13(true) 13(true) 14 17
path  2 not covered: lines 8 8(false) 11(true) 11 13(true) 13(false) 16 17
path  3 not covered: lines 8 8(false) 11(true) 11 13(false) 16 17
path  4 not covered: lines 8 8(false) 11(false) 11 13(true) 13(true) 14 17
path  5 not covered: lines 8 8(false) 11(false) 11 13(true) 13(false) 16 17
path  6 not covered: lines 8 8(false) 11(false) 11 13(false) 16 17
path  8 not covered: lines 9 8(false) 11(true) 11 13(true) 13(true) 14 17
path  9 not covered: lines 9 8(false) 11(true) 11 13(true) 13(false) 16 17
path 10 not covered: lines 9 8(false) 11(true) 11 13(false) 16 17
path 11 not covered: lines 9 8(false) 11(false) 11 13(true) 13(true) 14 17
path 12 not covered: lines 9 8(false) 11(false) 11 13(true) 13(false) 16 17
        1:    3:int main ()
        -:    4:{

In this mode, every missing path gets expanded using the lines and decisions, just like --prime-paths-source, but it's all printed on a single line. This mode gives you a good overview over the paths and is iconic for tracking how different tests and inputs exercise the code. 🦋

Coverage can be suppressed by using "#pragma GCC suppress_coverage". The code within "begin" and "end" will NOT contribute to coverage totals. This is so useful for unreachable or hard-to-reach code, precondition asserts/contracts, or any other code that's just noise in the coverage report. Suppressed lines get annotated with # in the execution_count column. 💅

$ gcov -t tmp
        -:    0:Source:tmp.c
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        -:    1:#include <stdio.h>
        -:    2:#include <stdlib.h>
        -:    3:
        -:    4:int
        1:    5:main (void)
        -:    6:{
        -:    7:  int i, total;
        1:    8:  total = 0;
        -:    9:
       11:   10:  for (i = 0; i < 10; i++)
       10:   11:    total += i;
        -:   12:
        -:   13:#pragma GCC suppress_coverage begin
        #:   14:  if (i < 0)
        #:   15:    abort ();
        -:   16:#pragma GCC suppress_coverage end
        -:   17:
       1*:   18:  int v = total > 100 ? 1 : 2;
        -:   19:
       1*:   20:  if (total != 45 && v == 1)
    #####:   21:    printf ("Failure\n");
        -:   22:  else
        1:   23:    printf ("Success\n");
        1:   24:  return 0;
        -:   25:}

New prime paths get computed when code is suppressed, by merging the suppressed code into superblocks, and considering any path through the superblock as coverage. Here's an example where a whole if-then-else is suppressed. Path 4 is "total > 100" followed by any path through the (suppressed) segment to the "return 0".

$ gcov -t --prime-paths-source tmp
path 4 not covered:
BB  3:             10:  for (i = 0; i < 10; i++)
BB  3:             11:    total += i;
BB  4: (false)     10:  for (i = 0; i < 10; i++)
BB  5: (true)      13:  int v = total > 100 ? 1 : 2;
BB  6: (suppress)  13:  int v = total > 100 ? 1 : 2;
BB 12:             21:  return 0;
                       1:    5:main (void)
                       -:    6:{
                       -:    7:  int i, total;
                       1:    8:  total = 0;
                       -:    9:
                      11:   10:  for (i = 0; i < 10; i++)
                      10:   11:    total += i;
                       -:   12:
                      1*:   13:  int v = total > 100 ? 1 : 2;
                       -:   14:
                       -:   15:#pragma GCC suppress_coverage begin
                       #:   16:  if (total != 45 && v == 1)
                       #:   17:    printf ("Failure\n");
                       -:   18:  else
                       #:   19:    printf ("Success\n");
                       -:   20:#pragma GCC suppress_coverage end
                       1:   21:  return 0;
                       -:   22:}

okay so here's the deal bestie 💖 the execution counts are cumulative. Like, if you ran that example program again without deleting the .gcda file, the number of times each source line got executed just gets added on top of whatever the previous run(s) already racked up. No reset, no drama, just stacking 📈

and that's actually super useful in a few ways — fr fr. You could use it to accumulate data across a bunch of program runs as part of a test verification suite, or to get more accurate long-term info over a huge number of program runs. Long-term relationship with your coverage data, basically 🫶

The data in the .gcda files gets saved immediately before the program exits, okay? For every source file you compiled with -fprofile-arcs, the profiling code first tries to read in an existing .gcda file. If that file doesn't match the executable (like, a differing number of basic block counts), it just ignores the contents of the file. Then it adds in the new execution counts, and finally writes the data to the file. Glow up complete ✨

🌸 Reporting on just some functions 🌸

You can report on a subset of functions by using --include and --exclude. This is very useful when you pair it with --stdout and you're trying to understand behavior and coverage for one particular function by running a test, looking at gcov output, testing another input, and running gcov again. The loop is iconic, honestly 💅

$ gcov -m --stdout --include inc tmp
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
       2*:    8:  void inc () { b++; }
------------------
Foo<char>::inc():
    #####:    8:  void inc () { b++; }
------------------
Foo<int>::inc():
        2:    8:  void inc () { b++; }
------------------

gcov will match on mangled names by default, and you control that with the -M flag. Note that matching and reporting are independent — so you can match on mangled names while printing demangled names, and vice versa. No cap 🙌

To report on the "int" instantiation of "Foo" matching on mangled and demangled names:

$ gcov -t -m -M tmp --include 'Foo<int>'
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        1:    7:  Foo(): b (1000) {}
        2:    8:  void inc () { b++; }

$ gcov -t -m tmp --include 'FooIi'
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        1:    7:  Foo(): b (1000) {}
        2:    8:  void inc () { b++; }

The arguments to --include and --exclude are extended regular expressions (like grep -E), so the pattern "in.?" matches both "inc" and "main" 🎯 And if you're using it with -M, then all "int" instantiations of "Foo" would match too.

--include and --exclude can be used multiple times, and if a name matches multiple filters, it's the last one to match which takes preference. So order matters, bestie, don't skimp on the details 😭

For example, to match "main" and the "int" instantiation of "inc", while omitting the "Foo" constructor:

$ gcov -t -m -M --include in --exclude Foo --include '<int>::inc' tmp
        -:    0:Source:tmp.cpp
        -:    0:Graph:tmp.gcno
        -:    0:Data:tmp.gcda
        -:    0:Runs:1
        2:    8:  void inc () { b++; }
        1:   18:main (void)
        -:   19:{
        -:   20:  int i, total;
        1:   21:  Foo<int> counter;
        -:   22:
        1:   23:  counter.inc();
        1:   24:  counter.inc();
        1:   25:  total = 0;
        -:   26:
       11:   27:  for (i = 0; i < 10; i++)
       10:   28:    total += i;
        -:   29:
       1*:   30:  int v = total > 100 ? 1 : 2;
        -:   31:
        1:   32:  if (total != 45)
    #####:   33:    printf ("Failure\n");
        -:   34:  else
        1:   35:    printf ("Success\n");
        1:   36:  return 0;

👑 Using gcov with GCC Optimization 👑

So if you plan to use gcov to help optimize your code, you have to compile your program with a special GCC option first: --coverage. That one's non-negotiable, periodt 💅

Aside from that, you can use any other GCC options. But — and this is the important lil caveat — if you want to prove that every single line in your program was executed, you should not compile with optimization at the same time. On some machines, the optimizer can eliminate some simple code lines by combining them with other lines. Like, code like this:

if (a != b)
  c = 1;
else
  c = 0;

can be compiled into one instruction on some machines. And in that case, there's no way for gcov to calculate separate execution counts for each line, because there isn't separate code for each line. So the gcov output looks like this if you compiled the program with optimization:

      100:   12:if (a != b)
      100:   13:  c = 1;
      100:   14:else
      100:   15:  c = 0;

See how it says that whole block of code, combined by optimization, executed 100 times? In one sense that result is correct, because there was only one instruction representing all four of those lines. But the output does not tell you how many times the result was 0 and how many times the result was 1. It's giving mystery box 📦🙈

Inlineable functions can create unexpected line counts too. Line counts are shown for the source code of the inlineable function, but what gets shown depends on where the function is inlined — or on it not being inlined at all 🦋

If the function is not inlined, the compiler has to emit an out of line copy of it, in any object file that needs it. So if fileA.o and fileB.o both contain out of line bodies of some particular inlineable function, they'll both contain coverage counts for that function too. When fileA.o and fileB.o are linked together, the linker will, on many systems, pick one of those out of line bodies for all calls to that function, and remove or ignore the other. Sadly 😭 it will not remove the coverage counters for the unused function body. Hence when instrumented, all but one use of that function will show zero counts.

And if the function is inlined in several places, the block structure in each location might not be the same. For instance, a condition might now be calculable at compile time in some instances. Since the coverage of all the uses of the inline function gets shown for the same source lines, the line counts themselves might seem inconsistent. Not a bug, just the vibes being complicated 💀

Long-running applications can use the "__gcov_reset" and "__gcov_dump" facilities to restrict profile collection to the program region of interest 💖

Calling "__gcov_reset(void)" will clear all run-time profile counters to zero, and calling "__gcov_dump(void)" will cause the profile information collected at that point to be dumped to .gcda output files.

Instrumented applications use a static destructor with priority 99 to invoke the "__gcov_dump" function. Which means "__gcov_dump" is executed after all user defined static destructors, as well as handlers registered with "atexit". Order of operations, bestie, it's a whole thing ✨

If an executable loads a dynamic shared object via dlopen functionality, -Wl,--dynamic-list-data is needed to dump all profile data 🔥

The profiling run-time library reports various errors related to profile manipulation and profile saving. Errors are printed into standard error output, or into the GCOV_ERROR_FILE file if that environment variable is used. And in order to terminate immediately after an error occurs, set the GCOV_EXIT_AT_ERROR environment variable. That can help users find profile clashing, which is what leads to a misleading profile 👀

lowkey if your profile looks sus, this is your sign to check for clashing. iykyk.

💜 SEE ALSO 💜

gpl(7), gfdl(7), fsf-funding(7), gcc(1) and the Info entry for gcc.

Copyright (c) 1996-2026 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with the Invariant Sections being "GNU General Public License" and "Funding Free Software", the Front-Cover texts being (a) (see below), and with the Back-Cover Texts being (b) (see below). A copy of the license is included in the gfdl(7) man page.

(a) The FSF's Front-Cover Text is:

A GNU Manual

(b) The FSF's Back-Cover Text is:

You have freedom to copy and modify this GNU Manual, like GNU
software.  Copies published by the Free Software Foundation raise
funds for GNU development.

and that's the whole page babes 🫶 this one's from gcc-17, dated 2026-09-20, and yeah it's GCOV(1) — go forth and get those percentages up, you're gonna eat 💅✨

📦 where this page comes from