coverage: Remove all unstable support for MC/DC instrumentation by Zalathar · Pull Request #144999 · rust-lang/rust

Zalathar · 2025-08-06T13:15:13Z

Preliminary support for a partial implementation of “Modified Condition/Decision Coverage” instrumentation was added behind the unstable flag -Zcoverage-options=mcdc in 2024. These are the most substantial PRs involved:

At the time, I accepted these PRs with relatively modest scrutiny, because I did not want to stand in the way of independent work on MC/DC instrumentation. My hope was that ongoing work by interested contributors would lead to the code becoming clearer and more maintainable over time.

However, that MC/DC code has proven itself to be a major burden on overall maintenance of coverage instrumentation, and a major obstacle to other planned improvements, such as internal changes needed for proper support of macro expansion regions.

I have also become reluctant to accept any further MC/DC-related changes that would increase this burden.

That tension has resulted in an unhappy impasse. On one hand, the present MC/DC implementation is not yet complete, and shows little sign of being complete at an acceptable level of code quality in the foreseeable future. On the other hand, the continued existence of this partial MC/DC implementation is imposing serious maintenance burdens on every other aspect of coverage instrumentation, and is preventing some of the very improvements that would make it easier to accept expanded MC/DC support in the future.

While I know this will be disappointing to some, I think the healthy way forward is accept that I made the wrong call in accepting the current implementation, and to remove it entirely from the compiler.

rustbot · 2025-08-06T13:15:18Z

r? @matthewjasper

rustbot has assigned @matthewjasper.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

rustbot · 2025-08-06T13:15:21Z

Some changes occurred in match lowering

cc @Nadrieril

Some changes occurred in compiler/rustc_codegen_ssa

cc @WaffleLapkin

Some changes occurred to MIR optimizations

cc @rust-lang/wg-mir-opt

oli-obk · 2025-08-07T10:52:30Z

r? @oli-obk

@bors r+

bors · 2025-08-07T10:52:33Z

📌 Commit 81ed042 has been approved by oli-obk

It is now in the queue for this repository.

Rollup of 19 pull requests Successful merges: - #144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - #144764 ([codegen] assume the tag, not the relative discriminant) - #144807 (Streamline config in bootstrap) - #144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - #144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - #144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - #144914 (Add support for `ty::Instance` path shortening in diagnostics) - #144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - #144999 (coverage: Remove all unstable support for MC/DC instrumentation) - #145009 (A couple small changes for rust-analyzer next-solver work) - #145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - #145042 (stdarch subtree update) - #145047 (move `type_check` out of `compute_regions`) - #145051 (Prevent name collisions with internal implementation details) - #145053 (Add a lot of NLL `known-bug` tests) - #145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - #145057 (Clean up some resolved test regressions of const trait removals in std) - #145068 (Readd myself to review queue) - #145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of #144999 - Zalathar:remove-mcdc, r=oli-obk coverage: Remove all unstable support for MC/DC instrumentation Preliminary support for a partial implementation of “Modified Condition/Decision Coverage” instrumentation was added behind the unstable flag `-Zcoverage-options=mcdc` in 2024. These are the most substantial PRs involved: - #123409 - #126733 At the time, I accepted these PRs with relatively modest scrutiny, because I did not want to stand in the way of independent work on MC/DC instrumentation. My hope was that ongoing work by interested contributors would lead to the code becoming clearer and more maintainable over time. --- However, that MC/DC code has proven itself to be a major burden on overall maintenance of coverage instrumentation, and a major obstacle to other planned improvements, such as internal changes needed for proper support of macro expansion regions. I have also become reluctant to accept any further MC/DC-related changes that would increase this burden. That tension has resulted in an unhappy impasse. On one hand, the present MC/DC implementation is not yet complete, and shows little sign of being complete at an acceptable level of code quality in the foreseeable future. On the other hand, the continued existence of this partial MC/DC implementation is imposing serious maintenance burdens on every other aspect of coverage instrumentation, and is preventing some of the very improvements that would make it easier to accept expanded MC/DC support in the future. While I know this will be disappointing to some, I think the healthy way forward is accept that I made the wrong call in accepting the current implementation, and to remove it entirely from the compiler.

Rollup of 19 pull requests Successful merges: - rust-lang/rust#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang/rust#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang/rust#144807 (Streamline config in bootstrap) - rust-lang/rust#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang/rust#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang/rust#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang/rust#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang/rust#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang/rust#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang/rust#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang/rust#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang/rust#145042 (stdarch subtree update) - rust-lang/rust#145047 (move `type_check` out of `compute_regions`) - rust-lang/rust#145051 (Prevent name collisions with internal implementation details) - rust-lang/rust#145053 (Add a lot of NLL `known-bug` tests) - rust-lang/rust#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang/rust#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang/rust#145068 (Readd myself to review queue) - rust-lang/rust#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

rust-lang/rust#144999

Rollup of 19 pull requests Successful merges: - rust-lang#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang#144807 (Streamline config in bootstrap) - rust-lang#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang#145042 (stdarch subtree update) - rust-lang#145047 (move `type_check` out of `compute_regions`) - rust-lang#145051 (Prevent name collisions with internal implementation details) - rust-lang#145053 (Add a lot of NLL `known-bug` tests) - rust-lang#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang#145068 (Readd myself to review queue) - rust-lang#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

Rollup of 19 pull requests Successful merges: - rust-lang/rust#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang/rust#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang/rust#144807 (Streamline config in bootstrap) - rust-lang/rust#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang/rust#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang/rust#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang/rust#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang/rust#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang/rust#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang/rust#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang/rust#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang/rust#145042 (stdarch subtree update) - rust-lang/rust#145047 (move `type_check` out of `compute_regions`) - rust-lang/rust#145051 (Prevent name collisions with internal implementation details) - rust-lang/rust#145053 (Add a lot of NLL `known-bug` tests) - rust-lang/rust#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang/rust#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang/rust#145068 (Readd myself to review queue) - rust-lang/rust#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

Rollup of 19 pull requests Successful merges: - rust-lang#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang#144807 (Streamline config in bootstrap) - rust-lang#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang#145042 (stdarch subtree update) - rust-lang#145047 (move `type_check` out of `compute_regions`) - rust-lang#145051 (Prevent name collisions with internal implementation details) - rust-lang#145053 (Add a lot of NLL `known-bug` tests) - rust-lang#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang#145068 (Readd myself to review queue) - rust-lang#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

Rollup of 19 pull requests Successful merges: - rust-lang/rust#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang/rust#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang/rust#144807 (Streamline config in bootstrap) - rust-lang/rust#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang/rust#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang/rust#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang/rust#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang/rust#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang/rust#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang/rust#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang/rust#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang/rust#145042 (stdarch subtree update) - rust-lang/rust#145047 (move `type_check` out of `compute_regions`) - rust-lang/rust#145051 (Prevent name collisions with internal implementation details) - rust-lang/rust#145053 (Add a lot of NLL `known-bug` tests) - rust-lang/rust#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang/rust#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang/rust#145068 (Readd myself to review queue) - rust-lang/rust#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

Rust stable -C instrument-coverage only emits block/region data (0 BRDA records in lcov). Branch coverage requires -Z coverage-options= branch (nightly-gated). RUSTC_BOOTSTRAP=1 unlocks -Z flags on the stable toolchain — coverage-only, non-instrumented builds stay pure stable for CI parity. Applied to both: - rio-workspace-cov (VM tests): RUSTFLAGS + RUSTC_BOOTSTRAP in covArgs - unit-test coverage: cargo-llvm-cov --branch + RUSTC_BOOTSTRAP genhtml --branch-coverage in both coverage-html and coverage-full so the HTML shows branch hit/miss annotations. Verified: minimal if/else test emits 2 BRDA records, 1 hit. Note: rust-lang/rust#144999 removed MC/DC (mcdc option), NOT branch. Valid options on rustc 1.93+nightly: block | branch | condition.

Rollup of 19 pull requests Successful merges: - rust-lang/rust#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang/rust#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang/rust#144807 (Streamline config in bootstrap) - rust-lang/rust#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang/rust#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang/rust#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang/rust#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang/rust#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang/rust#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang/rust#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang/rust#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang/rust#145042 (stdarch subtree update) - rust-lang/rust#145047 (move `type_check` out of `compute_regions`) - rust-lang/rust#145051 (Prevent name collisions with internal implementation details) - rust-lang/rust#145053 (Add a lot of NLL `known-bug` tests) - rust-lang/rust#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang/rust#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang/rust#145068 (Readd myself to review queue) - rust-lang/rust#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

… (RQ-57-MCDC) (#978) * feat(#912): MC/DC structural coverage over synth's own decision logic RQ-57-MCDC. #912 sat N/A for six releases on a surface argument: `witness` measures MC/DC on a Wasm artifact and synth emits ARM/RV32/A64 machine code, so "run witness on synth's output" is a category error. That is true about synth's OUTPUT and irrelevant — the decisions that ship a miscompile are in synth's own Rust, and those compile to Wasm fine. SURFACE, chosen on evidence (scripts/repro/mcdc_912_gate.md): * REJECTED native LLVM MC/DC — not a preference, the capability was REMOVED from rustc (rust-lang/rust#144999, merged 2025-08-08, Rust 1.91). Probed on three nightlies: `mcdc` is rejected, only `block|branch|condition` accepted. `condition` is the trap in the family — it builds, and it emits ZERO `llvm.instrprof.mcdc.*` intrinsics and zero mcdc_records. * REJECTED witness-over-the-fixtures-synth-compiles — it measures the fixture. gale's run named `pad_integral`, `do_count_chars`, `<u64 as Display>::fmt`, `write_prefix`, `cabi_realloc` and ZERO synth functions. A surface whose gap rows cannot name a synth decision cannot notice a missing condition in one. * CHOSEN witness over a wasm32-wasip1 build of synth's OWN crates. `synth-mcdc-harness` is a thin row driver — it calls the REAL pub fns with inputs arriving through Wasm params; it re-implements no predicate. THE RIGHT PARTS — scored where a missed condition HAS shipped a bug here: static_data_addr (VCR-VER-003 #777/#757/#798), alloc_validator (VCR-RA-003 #815; #871's fix WAS a condition added to the save-set predicate), and the RV32 bounds gate (#953/#959 — `mem_size == 0` was exempt from the power-of-two check, so `(memory 0)` emitted an identity mask and every access ran unmasked). EXCLUDED and named: instruction_selector (225 operator lines, its own lane); the aarch64 bounds closures (#865 — residual); wcet declines (match-dispatch, 1 operator line in 1061, so MC/DC has nothing to say there). MEASURED 20 decisions / 144 conditions / 63 proved / 31 gap / 50 dead, 3 at full MC/DC. Identical under witness 0.28.0 and 0.42.0. Gap rows are PRINTED with the closing vector — `is_ret` went 3-gap to 0-gap by adding exactly the three vectors witness named. THE GATE SCORES BY FUNCTION AND FLOORS COUNTS, for three reasons: the module-wide figure is 3/770 because wasip1 links wasi-libc + std; witness's `source_file` is an inlined-DWARF BASENAME and misattributes (resolve_owner's decision reports as static_data_addr.rs:355, it is at :274 — witness#179); and a ratio cannot notice a DELETED condition, which makes the percentage improve. RED-FIRST, two mutations, two distinct failure paths, both restored byte-identical: (a) delete `|| rs2 == Reg::RA` (the #871 fix) -> 19/142/54/2, all four floors trip; the condition-COUNT drop is what a ratio cannot produce. (b) drop one truth-table row (ra_validate:14) -> conditions stay 144, proved 63->62 and fully-proved 3->2. Wired as the `mcdc-structural-coverage` CI job, witness pinned to v0.42.0, with a non-vacuity assert so an empty scored table cannot print PASS. Refs #912 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * fix(#912): CI mode-126 on mcdc_run.sh, pin the toolchain, ceiling the dead count Three fixes from the first CI run and the cold read of it: 1. exit 126. `scripts/` is mode 644 in this repo (cf. scripts/oracle_run.py), so `./scripts/mcdc_run.sh` cannot exec on a fresh checkout even though it runs locally after a chmod. Invoke through `bash`, matching how every other script in this workflow is called. 2. PIN the toolchain to 1.96.1. The floors are counts of decisions and conditions RECONSTRUCTED FROM LOWERED WASM, so they are sensitive to how `std` inlines. `@stable` is a moving target and a Rust release could red this gate with no code change. Bumping the pin is allowed and obliges a RE-MEASURE, not a lowering. (Witness-version invariance — 0.28 = 0.42 — is evidence about witness, not about rustc; it does not transfer.) 3. CEILING the dead count at the measured 50. 50 of 144 scored conditions are never evaluated (40 in `is_straight_line`, whose match arms cover RV32 opcodes the row set does not construct). That residual was the one number in the table nothing guarded: a change that stopped reaching the segment barriers would raise `dead`, lower nothing else, and PASS. It is also a third potency surface — mutation (a) moves dead 50 -> 52, so the mutated run now trips five floors instead of four. Also trims the `sd_resolve_owner` doc comment, which claimed vectors the measurement does not show: its 2 gap conditions are now stated as a measured residual rather than implied closed. Baseline re-verified unchanged: 20 / 3 / 144 / 63 / 31 / 50, PASS. Refs #912 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * TEMPORARY red-first probe (#912) — DO NOT MERGE THIS COMMIT Reverted by the very next commit. Two things in one CI run: 1. RE-MEASURE the floors on the platform the gate actually runs on. The first CI run proved what could only be argued locally: these counts are PLATFORM-dependent, not just toolchain-version dependent. ubuntu x86_64, rustc 1.96.1, witness 0.42.0: 22 / 130 / 57 / 23 gap / 50 dead, 4 full macOS aarch64, rustc 1.96.1, witness 0.42.0: 20 / 144 / 63 / 31 gap / 50 dead, 3 full Same toolchain version, same witness, same 56 rows, different host. `validate_final_allocation_rv32` presents as 9 decisions / 44 conditions on Linux and 4 / 43 on macOS; `ensure_supported_target` vanishes on Linux. Floors move to the CI numbers — RE-MEASURED, not lowered to fit. Both baselines are recorded in the script so the macOS delta is a stated fact rather than a surprise. 2. RE-PROVE POTENCY ON THAT PLATFORM. The local mutation evidence does NOT obviously transfer when the same function presents as 9 decisions instead of 4 — and "it obviously still works" is the reasoning this whole lane exists to distrust. So this commit ALSO deletes the #871 condition `|| rs2 == Reg::RA` from the RV32 allocation validator's save-set predicate. The MC/DC job must go RED on the condition-COUNT floor, and the VCR-RA-003 RV32 job should go red independently. If this commit is green, the gate is vacuous and the lane is wrong. Refs #912 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * TEMPORARY red-first probe 2/2 (#912) — DO NOT MERGE, reverted next commit Probe 1 (25a9195) went RED on CI as required, but at the WRONG STEP for the evidence I wanted: the row-driver sanity gate (step 7) asserts `ra_validate(4) == 1` (#871: unsaved ra must be a violation), so deleting `|| rs2 == Reg::RA` fails there and the MC/DC measurement never runs. Two independent gates catching one mutation is good engineering and useless as proof that the MC/DC FLOORS bite. This probe isolates them. It restores the source byte-identical (verified: empty `git diff` vs the pre-mutation tree) and instead drops ONE truth-table row — `ra_validate:14`, the non-sp `Lw` that gives `sp_slot_load` its unique-cause pair. That touches no compiler behaviour, so: step 7 (row-driver sanity) must PASS step 8 (witness run) must PASS step 9 (MC/DC floors) must FAIL on and Conditions must stay at 130 — coverage lost, nothing deleted. That is the second of the two potency paths, and the one that proves the SCORING floor itself is what goes red, on the platform it actually runs on. Refs #912 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(#912): restore the probes, record the CI-platform potency evidence Both red-first probes reverted; the tree is byte-identical to 712f658 for crates/synth-backend-riscv/src/alloc_validator.rs and scripts/mcdc_run.sh (verified with an empty \$(git diff 712f658 -- <path>) on each). What the two CI probes established, which the local run could not: PROBE 1 (delete the #871 condition) went RED — at the WRONG STEP. The job's own row-driver sanity gate asserts ra_validate(4) == 1 and fails there, so the MC/DC measurement never ran; the VCR-RA-003 RV32 job went red independently too. Three gates catching one mutation is good engineering and NO evidence that the MC/DC floors bite. Recording it because 'a red gate is not evidence that the gate you were testing works' generalises well past this lane — read WHICH STEP failed. PROBE 2 (drop one truth-table row, no compiler behaviour touched) isolated them. Run 31821746035: sanity gate PASS, witness run PASS, SCORING STEP FAIL. baseline 22 4 130 57 23 50 probe 2 22 3 130 56 24 50 FAIL: proved conditions 56 < floor 57 FAIL: fully-proved decisions 3 < floor 4 Decisions unchanged, CONDITIONS UNCHANGED at 130 — nothing deleted — while proved fell and a decision dropped out of full MC/DC. That is the signature of coverage lost with structure intact, produced by the MC/DC scoring step itself, on the platform the gate blocks on. Refs #912 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Rollup of 19 pull requests Successful merges: - rust-lang#144400 (`tests/ui/issues/`: The Issues Strike Back [3/N]) - rust-lang#144764 ([codegen] assume the tag, not the relative discriminant) - rust-lang#144807 (Streamline config in bootstrap) - rust-lang#144899 (Print CGU reuse statistics in `-Zprint-mono-items`) - rust-lang#144909 (Add new `test::print_merged_doctests_times` used by rustdoc to display more detailed time information) - rust-lang#144912 (Resolver: introduce a conditionally mutable Resolver for (non-)speculative resolution.) - rust-lang#144914 (Add support for `ty::Instance` path shortening in diagnostics) - rust-lang#144931 ([win][arm64ec] Fix msvc-wholearchive for Arm64EC) - rust-lang#144999 (coverage: Remove all unstable support for MC/DC instrumentation) - rust-lang#145009 (A couple small changes for rust-analyzer next-solver work) - rust-lang#145030 (GVN: Do not flatten derefs with ProjectionElem::Index. ) - rust-lang#145042 (stdarch subtree update) - rust-lang#145047 (move `type_check` out of `compute_regions`) - rust-lang#145051 (Prevent name collisions with internal implementation details) - rust-lang#145053 (Add a lot of NLL `known-bug` tests) - rust-lang#145055 (Move metadata symbol export from exported_non_generic_symbols to exported_symbols) - rust-lang#145057 (Clean up some resolved test regressions of const trait removals in std) - rust-lang#145068 (Readd myself to review queue) - rust-lang#145070 (Add minimal `armv7a-vex-v5` tier three target) r? `@ghost` `@rustbot` modify labels: rollup

) ## Summary This updates every dependency, CI action, CI tool, runner image and toolchain to its newest release, and stops pinning them. Both lockfiles are refreshed with `cargo update`. Workflows name actions by their major tag instead of a commit SHA, install tools without a version, and use the `stable` and `nightly` toolchains and the `-latest` runner images. The only pin left is the MC/DC job's nightly, which is technically required (see "Pins that remain"). The published crate does not change: its dependency requirements (`rowan`, which the parallel rowan 0.17 PR moves, is untouched here) and its `rust-version` stay the same. Supersedes the Dependabot pull requests #74, #77, #78, #79 and #97. ## Motivation The owner asked to update rowan and all other dependencies without pinning anything, and allowed breaking changes because 0.5 is not released yet. This PR covers everything except rowan. No audit finding is involved. Floating has a cost that TigerStyle names under Dependencies: "Dependencies, in general, inevitably lead to supply chain attacks, safety and performance risk". With SHA pins, a new action release only reached CI through a reviewed Dependabot pull request, after a 7-day cooldown. Now a new release within a major tag runs in CI at once, including in the `release` job, which holds `CARGO_REGISTRY_TOKEN`. The deviation row in docs/standards.md now states this cost. See "Risks of floating" below. ## Bug: before and after Only the fuzz crate's dependency requirement was wrong. `libfuzzer-sys = "0.4"` admitted 0.4.0 to 0.4.6, and those releases cannot compile the fuzz targets: ```sh cargo update --manifest-path fuzz/Cargo.toml -p libfuzzer-sys --precise 0.4.6 cargo check --manifest-path fuzz/Cargo.toml --bins ``` Before: the update is accepted, and all six fuzz targets fail to compile, because `fuzz_target!` before 0.4.7 rejects expression bodies such as `|data: &[u8]| round_trip::check(data)`. Each error is `` error: no rules expected `<module>` `` for the module that the target's body calls: `round_trip`, `generated_edits`, `editor_reparse` and `editor_stateful` for the targets of those names, `editor_ops` for `editor` and `editor_inputs` for `inputs`. After: `libfuzzer-sys = "0.4.7"` rejects the downgrade (`failed to select a version for the requirement libfuzzer-sys = "^0.4.7"; candidate versions found which didn't match: 0.4.6`). 0.4.7 builds every target. ## Changes **Cargo** - `Cargo.lock`: a plain `cargo update` reaches the newest release of everything except rowan. insta 1.47.2 -> 1.49.0, configparser 3.1.0 -> 3.3.0, console 0.16.3 -> 0.16.6, fastrand 2.4.1 -> 2.5.0, getrandom 0.4.2 -> 0.4.3, libc 0.2.186 -> 0.2.191, rustix 1.1.4 -> 1.1.5 and cfg-if 1.0.4 -> 1.0.5. getrandom 0.4.3 no longer pulls in the wasip2 and wasip3 tree (wit-bindgen, wasm-*, serde, syn and more), so the lockfile drops from 69 to 33 packages. - `fuzz/Cargo.lock`: libfuzzer-sys 0.4.12 -> 0.4.13, arbitrary 1.4.2 -> 1.5.0, cc 1.2.63 -> 1.10.0, getrandom 0.3.4 -> 0.4.3, jobserver 0.1.34 -> 0.1.35, r-efi 5.3.0 -> 6.0.0, find-msvc-tools 0.1.9 -> 0.1.15, libc 0.2.186 -> 0.2.191 and cfg-if 1.0.4 -> 1.0.5. wasip2 and wit-bindgen drop out (19 -> 17 packages). ini-edit's own entry is unchanged (0.4.0), and `cargo metadata --locked` accepts the lockfile. - `fuzz/Cargo.toml`: `libfuzzer-sys = "0.4.7"`, with a comment that says why. - `Cargo.toml`: the dev-dependency requirements stay as they are (`insta = "1"`, `rust-ini = "0.21.3"`, `configparser = "3.1.0"`). These are caret ranges, not pins. A new comment explains that looser ones would admit releases that fail: with rust-ini 0.21.0 the benchmark fails to compile (no `ParseOption::enabled_indented_mutiline_value`), and with configparser 3.0.0 the benchmark and the differential test do (no `WriteOptions` and no `set_inline_comment_symbols`). I checked both. With configparser 3.1.0 the differential test still passes and the benchmark builds. - `rust-version` stays 1.85 in both manifests. Edition 2024 sets that floor, and configparser 3.3.0 and getrandom 0.4.3 declare 1.85 too. No dependency needs a newer compiler. - `deny.toml`: only the comment changes. The dev-dependencies now resolve two versions of getrandom only, no longer wit-bindgen. **CI** (`ci.yml`, `coverage.yml`, `release-pr.yml`) | Item | Before | After | |---|---|---| | actions/checkout | SHA (v7.0.1) | `@v7` | | actions/cache/restore, actions/cache/save | SHA (v6.1.0) | `@v6` | | actions/upload-artifact | SHA (v7.0.1) | `@v7` (now v7.0.2) | | codecov/codecov-action | SHA (v7.1.1) | `@v7` | | Swatinem/rust-cache | SHA (v2.9.3) | `@v2` | | taiki-e/install-action | SHA (v2.87.16) | `@v2` (now v2.87.30) | | release-plz/action | SHA (v0.5.140, release-plz 0.3.170) | `@v0.5` (now v0.5.145, release-plz 0.4.0) | | dtolnay/rust-toolchain | SHA (master) | `@master`, as its README prescribes when `toolchain:` is set | | cargo-nextest, cargo-mutants, cargo-llvm-cov, cargo-fuzz, cargo-deny | `@0.9.145`, `@27.1.0`, `@0.9.1`, `@0.13.2`, `@0.20.2` | no version: the newest that install-action offers (today 0.9.148, 27.1.0, 0.9.1, 0.13.2, 0.20.2) | | sanitizers, miri-strict, miri, fuzz, branch coverage | `nightly-2026-09-17` | `nightly` | | MC/DC coverage | `nightly-2025-06-01` | `nightly-2025-08-08` (required pin, see below) | | msrv | `1.85.0` written in ci.yml | read from `rust-version` in Cargo.toml, with `.0` appended when it has no patch number | | runners | `ubuntu-24.04`, `macos-26`, `windows-2025` | `ubuntu-latest`, `macos-latest`, `windows-latest` (the same images today) | Every major tag already points at the newest release of its action, so no major version changes. install-action's "latest" can trail crates.io by a few days: crates.io has had cargo-nextest 0.9.149 since 2026-10-20, but install-action@v2 still installs 0.9.148. cargo-fuzz is not in install-action's manifests, so it falls back to cargo-binstall, which takes crates.io's newest. The comments that described the pins are rewritten: the workflow header, the sanitizer toolchain comment, the release-plz version comments and the MC/DC pin's reason. **Dependabot** (`.github/dependabot.yml`): both ecosystems and the 7-day cooldown stay. With major tags, Dependabot only proposes new majors. The comments now say so, and say that a release within a major reaches CI without the cooldown. **Documents** - TESTING.md and CONTRIBUTING.md: every `+nightly-2026-09-17` command is now `+nightly`, and MC/DC uses `+nightly-2025-08-08` with the reason. The dead `RUSTFLAGS='--cfg no_zerocopy_simd_x86_avx12_1_89_0'` is removed: criterion and zerocopy left in #96, and MC/DC reaches 100% without it. The zerocopy history is now in the past tense and names the nightly it failed on, nightly-2025-06-01 (AVX-512 is stable on nightly-2025-08-08), and the release checklist names the `-latest` runners. CONTRIBUTING.md tells contributors to run `rustup update stable nightly` when CI and a local run disagree. - docs/standards.md: the "Process" deviation row about pinning now describes what floats, what stays fixed and why, and the accepted costs (red runs from new releases, and supply-chain exposure). The "zero dependencies" row no longer says that the benchmarks run on criterion and compare against ini_core, or that a std-only harness is planned: since #96 the benchmark compares against rust-ini and configparser with a std-only harness. That row's "four dependencies" of rowan is left to the rowan 0.17 PR, which changes it; the two PRs then touch that one row, and resolving it is trivial. For contributors: install `nightly-2025-08-08` with `llvm-tools-preview` for MC/DC, and keep `nightly` up to date for everything else. `nightly-2025-06-01` and `nightly-2026-09-17` are no longer used. ## Pins that remain 1. **`nightly-2025-08-08` for the MC/DC job** (coverage.yml, with a comment). rustc removed its MC/DC instrumentation in [rust-lang/rust#144999](rust-lang/rust#144999), merged 2025-08-08 09:09 UTC. nightly-2025-08-08 (rustc 1.91.0-nightly 2fd855fbf 2025-08-07) is the last nightly that accepts `-Zcoverage-options=mcdc`. The latest nightly rejects it: ``incorrect value `mcdc` for unstable option `coverage-options` - `block` | `branch` | `condition` was expected``. The only alternative is the latest nightly's `-Zcoverage-options=condition`. That is condition coverage, which is weaker: it does not show that each condition independently changes its decision, which docs/standards.md relies on. So the owner would have to choose it explicitly. 2. **The MSRV toolchain (1.85.0).** This is the declared `rust-version`, a promise to users, not a version chosen for CI. ci.yml no longer writes it: the msrv job reads it from Cargo.toml, so the job moves when `rust-version` moves. README.md, CONTRIBUTING.md and the `rust-version` of fuzz/Cargo.toml also state the version and must be updated with it; the msrv job's comment lists them. 3. Not pins, for completeness: `Cargo.lock` and `fuzz/Cargo.lock` record exact versions because that is what a lockfile is, and both are refreshed to the newest releases. Dependabot keeps them fresh weekly. `rowan = "0.16"` is left to the rowan 0.17 PR. ## Risks of floating - A new stable, nightly, Miri, clippy lint, tool release or runner image can turn any run red without a change in this repository, including the 100% coverage gates (compilers count regions differently). Today's releases are green on every check below. Each new nightly also misses the rust-cache once, because the cache key includes the rustc version. - The MC/DC job depends on two things that no longer move together: cargo-llvm-cov still has `--mcdc` (0.9.1, which I ran, see below), and every future dev-dependency must keep building on a 2025 nightly. If cargo-llvm-cov drops `--mcdc`, pinning cargo-llvm-cov becomes the next technically required pin. - `release-plz/action@v0.5` without a `version:` input picks up each new release-plz. It moved to release-plz 0.4.0 today. 0.4.0's one breaking change is in the release_plz_core library API (#3263), not in the CLI or the configuration we use. - Supply chain: a compromised release of any action or tool now runs in CI without review, including in the `release` and `release-pr` jobs, which hold `CARGO_REGISTRY_TOKEN` and `RELEASE_PLZ_TOKEN`. SHA pins only in those two jobs would remove that exposure. This PR does not do that, because the instruction was to pin nothing. zizmor's default `unpinned-uses` policy flags the non-`actions/*` actions. CI does not run zizmor; a local run needs `rules.unpinned-uses.config.policies: {"*": ref-pin}`. ## Verification All commands ran locally with `CARGO_BUILD_JOBS=8`, `RUST_TEST_THREADS=8`, `RUSTFLAGS='--deny warnings'` as ci.yml sets it (the coverage jobs without it, as coverage.yml runs them), and the toolchains this PR selects: stable 1.99.1, nightly 1.101.0-nightly 7189d39d9 (2026-10-22), nightly-2025-08-08 and 1.85.0. Most checks ran before the review fixes. Those fixes change only comments in ci.yml, Markdown and commit messages, and the checks marked "(re-run at head)" ran again on the final head. - `cargo fmt --all --check` and `cargo fmt --manifest-path fuzz/Cargo.toml --check` (re-run at head): clean. - `cargo clippy --locked --all-targets --all-features -- --deny warnings` (re-run at head): clean. The fuzz crate's clippy (`--locked`) is clean too. - `cargo test --locked --all-targets --all-features` (all of this bullet re-run at head): 415 passed, 0 failed, 17 ignored. With `--release`: 394 passed, 17 ignored. `--doc`: 14 passed. `cargo doc` with `RUSTDOCFLAGS=--deny warnings`: clean. tests/style.rs, which also checks the workflow files' widths, passes. All 31 insta snapshots match, and no `.snap.new` or `.pending-snap` file appeared. - msrv job: its own step script (taken from ci.yml with yq, re-run at head) reads `1.85` from Cargo.toml and outputs `toolchain=1.85.0`. `cargo +1.85.0 test --locked --all-targets --all-features`: 415 passed, 17 ignored. `--doc`: 14 passed. - Branch coverage on nightly (2026-10-22): 100% branches 252/252, functions 285/285, instantiations 301/301, lines 2013/2013, regions 2380/2380. These are the same counts as on nightly-2026-09-17. The first run used the local cargo-llvm-cov 0.9.0. At head I re-ran the job's two shell steps, extracted from coverage.yml, with cargo-llvm-cov 0.9.1, the release that install-action@v2 installs in CI (its prebuilt binary, checked against install-action's SHA-256). The totals are identical, and the `jq --exit-status` gate prints `true`. - MC/DC on nightly-2025-08-08, without the zerocopy RUSTFLAGS: 100% MC/DC 27/27, branches 264/264, functions 279/279, instantiations 295/295, lines 2151/2151, regions 3783/3783. The CI `jq --exit-status` gate prints `true`. As with branch coverage, the first run used cargo-llvm-cov 0.9.0, and the job's shell step re-run at head with 0.9.1 gives identical totals, so 0.9.1 still has a working `--mcdc`. - Strict Miri on nightly: the lexer tests (48 passed) and `lexer_and_diagnostic_contracts` (1 passed) pass on x86_64, i686 and s390x. `cargo miri nextest run --lib --partition hash:1/4` with `-Zmiri-disable-stacked-borrows`, filtered to the lexer tests, runs 17 tests, all passing. The first run used the local cargo-nextest 0.9.146. At head I re-ran it with cargo-nextest 0.9.148, the release that install-action@v2 installs in CI today (prebuilt, SHA-256 checked): 17 passed, 247 skipped. - sanitizers job on nightly: 415 passed and 17 ignored under AddressSanitizer and LeakSanitizer, and 14 doctests passed. The test binary contains `__asan_report_*` symbols. - fuzz job on nightly with cargo-fuzz 0.13.2: I ran its five shell steps exactly as extracted from ci.yml. The target-list check passes, and `cargo fetch --locked` succeeds. All 6 targets build without warnings. All 4,799 committed regressions replay cleanly with `-runs=0`: editor 1096, editor_reparse 370, editor_stateful 715, generated_edits 801, inputs 1067 and round_trip 750. The 10-second campaign of each target found nothing, and no artifacts were written. - The libfuzzer-sys floor (re-run at head, in a scratch copy): with `libfuzzer-sys = "0.4"` and `--precise 0.4.6`, `cargo check --manifest-path fuzz/Cargo.toml --bins` fails for all six targets with the errors quoted above. With `--precise 0.4.7`, all six build without warnings. With this PR's `"0.4.7"`, `cargo update --precise 0.4.6` is rejected with the message quoted above. - `cargo deny --locked check advisories bans licenses sources` (cargo-deny 0.20.2, the newest release): advisories ok, bans ok, licenses ok, sources ok. - package job: I ran its three steps exactly as extracted from ci.yml. The repository-only and shipped-file checks pass, and `cargo package --locked` succeeds. The extracted crate, which ships the refreshed Cargo.lock, passes 398 tests (12 ignored) and 14 doctests outside the repository. - `required` job wiring check (run locally with the needs list as successes): passes. - actionlint 1.7.12 (the newest release, with shellcheck 0.11.0, which I checked it runs) on all three workflows (re-run at head): no findings. The comment at ci.yml's `coverage` job about actionlint 1.7.12 is still accurate. - Mutation testing (cargo-mutants 27.1.0, re-run at head): `cargo mutants --in-diff` reports "Diff changes no Rust source files", so there are 0 mutants. - Action tags (re-checked at head with `git ls-remote`): each major tag that the workflows use resolves to the same commit as its action's newest release tag, and none of the actions has a newer major. - Not run locally: the macOS and Windows jobs, the native i686 job (this machine has no 32-bit C library), the ignored extended suites, full-library Miri and the full mutation run. CI runs all of them. --------- Co-authored-by: Claude <noreply@anthropic.com>

coverage: Remove all unstable support for MC/DC instrumentation

81ed042

Zalathar added A-code-coverage Area: Source-based code coverage (-Cinstrument-coverage) F-coverage-mcdc MC/DC coverage via -Cinstrument-coverage with -Zcoverage-options=mcdc labels Aug 6, 2025

rustbot assigned matthewjasper Aug 6, 2025

rustbot assigned oli-obk and unassigned matthewjasper Aug 7, 2025

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 7, 2025

Zalathar mentioned this pull request Aug 8, 2025

Rollup of 19 pull requests #145077

Merged

bors merged commit 562222b into rust-lang:master Aug 8, 2025

rustbot added this to the 1.91.0 milestone Aug 8, 2025

Zalathar deleted the remove-mcdc branch August 8, 2025 09:36

taiki-e added a commit to taiki-e/cargo-llvm-cov that referenced this pull request Aug 10, 2025

ci: Unstable MC/DC support has been removed in upstream

48538fb

rust-lang/rust#144999

Nadrieril mentioned this pull request Oct 8, 2025

Support mcdc analysis for pattern matching #124278

Closed

This was referenced May 1, 2026

docs(README): retire TQL aspiration; spell out independence + MC/DC limits luofang34/Evidence#114

Merged

feat(boundary): DAL-A MC/DC fail-loud at cert/record; warn at dev luofang34/Evidence#115

Merged

avrabe mentioned this pull request Aug 14, 2026

chore(release): v0.57.0 — "the checkers were the defects" pulseengine/synth#980

Merged

This was referenced Aug 26, 2026

Measure and ratchet compiler structural coverage; MC/DC for safety passes almide/almide#566

Closed

Qualified MC/DC coverage tooling — GNATcoverage + GNATPro for Rust (the pedigree path rustc abandoned) almide/als#51

Open

jjant mentioned this pull request Oct 23, 2026

chore: update every dependency, tool and toolchain and stop pinning jjant/ini-edit#98

Merged

Navigation Menu

Repository navigation

coverage: Remove all unstable support for MC/DC instrumentation - #144999

coverage: Remove all unstable support for MC/DC instrumentation#144999
bors merged 1 commit into
rust-lang:masterfrom
Zalathar:remove-mcdc

Zalathar commented Aug 6, 2025 •

edited by rustbot

Loading

Uh oh!

rustbot commented Aug 6, 2025

Uh oh!

rustbot commented Aug 6, 2025

Uh oh!

oli-obk commented Aug 7, 2025

Uh oh!

bors commented Aug 7, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Zalathar commented Aug 6, 2025 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Aug 6, 2025

Uh oh!

rustbot commented Aug 6, 2025

Uh oh!

oli-obk commented Aug 7, 2025

Uh oh!

bors commented Aug 7, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Zalathar commented Aug 6, 2025 •

edited by rustbot

Loading