Prime Path Coverage in the GNU Compiler Collection

TL;DR

The paper presents a GCC v15 implementation of prime path coverage, a structural path-coverage criterion that subsumes MC/DC and offers a practical balance between test count and defect detection. It introduces a suffix-tree-based enumeration method that reduces path-pruning complexity to $O(n^2 m)$ from $O(n^2 m^2)$ and employs bitset-based instrumentation to track prime-path execution with minimal overhead. Prime paths are represented and reported via gcov, enabling precise guidance on code to exercise for coverage while recomputing paths from the CFG as needed. The work also discusses thresholds to control path explosion and identifies bottlenecks in large SCCs and instrumentation passes, outlining future directions for heuristics and potential extensions to path frequencies and industry uptake.

Abstract

We describe the implementation of the prime path coverage support introduced the GNU Compiler Collection 15, a structural coverage metric that focuses on paths of execution through the program. Prime path coverage strikes a good balance between the number of tests and coverage, and requires that loops are taken, taken more than once, and skipped. We show that prime path coverage subsumes modified condition/decision coverage (MC/DC). We improve on the current state-of-the-art algorithms for enumerating prime paths by using a suffix tree for efficient pruning of duplicated and redundant subpaths, reducing it to $O(n^2m)$ from $O(n^2m^2)$, where $n$ is the length of the longest path and $m$ is the number of candidate paths. We can efficiently track candidate paths using a few bitwise operations based on a compact representation of the indices of the ordered prime paths. By analyzing the control flow graph, GCC can observe and instrument paths in a language-agnostic manner, and accurately report what code must be run in what order to achieve coverage.

Figures (12)

• Figure 1: Assume is a global int. Testing with 5 and 25 satisfies branch coverage, but does not trigger the bug (dereferencing when is ). Prime path coverage would require both decisions to be . The example is from Regehr regehr872.
• Figure 2: The 41 simple paths and 4 prime paths for the CFG for two sequential decisions. Executing the prime paths would cover all simple paths.
• Figure 3: BDD for the Boolean expression a or (b and c) or d. The double circle vertices 5 and 6 are the true and false outcome, respectively. Rows 1, 2, 5, 7, 9 (paths $P_5$, $P_4$, $P_2$, $P_3$, $P_6$) would achieve MC/DC, but row 6 (path $P_1$) would have to be included for prime path coverage.
• Figure 4: A binary search with its control flow graph and 17 prime paths, showing that even short and relatively simple functions can have many prime paths. Note that block 9 is the action of the return, the transfer of control back to the caller.
• Figure 5: Most of the CFG is inside a single component.

Theorems & Definitions (2)

• Proposition
• proof