r266672 - [sanitizer-coverage] better docs for -fsanitize-coverage=trace-bb
Kostya Serebryany via cfe-commits
cfe-commits at lists.llvm.org
Mon Apr 18 14:28:37 PDT 2016
Date: Mon Apr 18 16:28:37 2016
New Revision: 266672
[sanitizer-coverage] better docs for -fsanitize-coverage=trace-bb
--- cfe/trunk/docs/SanitizerCoverage.rst (original)
+++ cfe/trunk/docs/SanitizerCoverage.rst Mon Apr 18 16:28:37 2016
@@ -286,10 +286,26 @@ These counters may also be used for in-p
Tracing basic blocks
-An *experimental* feature to support basic block (or edge) tracing.
+Experimental support for basic block (or edge) tracing.
With ``-fsanitize-coverage=trace-bb`` the compiler will insert
``__sanitizer_cov_trace_basic_block(s32 *id)`` before every function, basic block, or edge
(depending on the value of ``-fsanitize-coverage=[func,bb,edge]``).
+.. code-block:: console
+ % clang -g -fsanitize=address -fsanitize-coverage=edge,trace-bb foo.cc
+ % ASAN_OPTIONS=coverage=1 ./a.out
+This will produce two files after the process exit:
+`trace-points.PID.sancov` and `trace-events.PID.sancov`.
+The first file will contain a textual description of all the instrumented points in the program
+in the form that you can feed into llvm-symbolizer (e.g. `a.out 0x4dca89`), one per line.
+The second file will contain the actual execution trace as a sequence of 4-byte integers
+-- these integers are the indices into the array of instrumented points (the first file).
+Basic block tracing is currently supported only for single-threaded applications.
More information about the cfe-commits