Find dead code in a C program by runtime analysis

Question

I have a large application written in C + POSIX there are many functions which are never called inside it. However, due to the size of the code it is difficult to track them manually.
Some people have suggested to use gcc with-Wunusedand lto, but it didn't returned any used functions, whereas I continue to find and remove some manually.

So I think I need a code coverage tool for analysing the program at run-time. Peoples suggested me gcov or valgrind, but I was unable to find how to use them to print a list of dead functions. gcov alone revealed only 68% of the functions compiled are used, but I don't have any way to list them.

So does someone know a good tool, and if so tell me how exactly I can use it for that purpose (a command line example would be welcome)?

I removed all functions which are not used in the source code. Only functions like this remain inside the source code :

if(conditional statement) {
    some stuff;
    dead_function();
    some_stuff;
}

Whereconditional statementis never true at run time, and the removal ofdead_function()would lead to the removal of the statement to avoid undefined errors.

Answer 1

Given that @user2284570 is in the comfortable situation of covering 100% of use cases via tests dynamic code analysis will provide the answer. In other cases removal of functions, their calls and conditions would require a thorough review.

Any code coverage tool will report function coverage in one form or the other. The main gripe seems to be reporting of the exact location of unused (here: dead) functions. I cannot speak for other tools but our company's has a text format reporting option that features placeholders for source file name and line data. Since a concrete command line example was asked for here's one:

$ csgcc -o myapp mycode.c
$ ./myapp --run-all-tests
$ cmcsexeimport -m myapp.csmes -e myapp.csexe --title=mytests
$ cmreport --function-coverage -m myapp.csmes --format-unexecuted='%f:%l'

This will print the dead function locations like:

mycode.c:101
mycode.c:213
mycode.c:1032

A local university student wrote up more detailed instructions for this approach.

After eliminating unused functions you'll also want to analyze Branch Coverage and removed superfluous if() statements and others. Just beware of side effects of evaluated expressions. But luckily, your perfect code coverage will detect regressions.

Answer 2

You can use splint with the alluse flag to check for unused functions but personally I would use doxygen to produce a call map - any functions that have no parents are probably unused - just look out for any functions that are in tables of functions that might not be directly called but things like state machines might invoke from the table index.

Doxygen is an invaluable tool for dealing with large code bases and is well worth learning how to use in any case, it is free and available for multiple platforms, it also tends to encourage documenting your code as you go.

In the case of code that is called but only from unreachable code you will have to use a full static analysis tool like LDRA, (costly), that will point you to unreachable code. In this case it is better to remove all unreachable code first then look for uncalled functions. Alternatively you will need a test suite that you are sure exercises 100% of the functionality - then you can use a profiler or coverage tool like gcov on your program while running your test suite. If your test has exercised all of your functionality and you have portions with 0% coverage then they are uncalled but you will then have to find the calls to them that are unreachable and remove that code for the linker not to complain anyway.

Answer 3

To answer your revised question - if you compile all your code with gcc -fprofile-arcs -ftest-coverage options set and then run a suite of tests which you are sure covers all the functionality and all the possibilities, (possibly across several runs).

The gcov utility does expect you to do some of the work - it doesn't simply have an option for "tell me what didn't get called" so you will have to find those functions that didn't get called.

You can use gcov with the --function-summaries option on each source file you will generate a set of output files which will include function summaries - look for any of those that include either never or 0% to find the un-executed functions.

I would suggest either adding a function that you know will never be called or knowing about one that you haven't removed yet - this will let you see what the output looks like - you can then use grep to find them all.

Your next step will be to use grep or something similar to look at the gcov output for all the places that those functions are present in your code - you should see execution counts of 0 for the entire branch containing the call this will give you a good starting point for either extending your tests - for use cases that you had missed - or for code removal.