bug(`forge coverage`): constructor array length checks not properly recognized

[ebadiere]

Component

Forge

Have you ensured that all of these are up to date?

• Foundry
• Foundryup

What version of Foundry are you on?

forge --version forge Version: 1.0.0-stable Commit SHA: e144b82 Build Timestamp: 2025-02-13T20:02:34.979686000Z (1739476954) Build Profile: maxperf

What version of Foundryup are you on?

foundryup --version foundryup: 1.0.1

What command(s) is the bug in?

forge coverage --report summary

Operating System

macOS (Apple Silicon)

Describe the bug

Bug Description

The Foundry coverage tool fails to recognize certain branches in Solidity code, particularly in constructors with conditional checks on array lengths. Even with tests that explicitly exercise both branches of a condition, the tool fails to recognize that both branches have been covered.

Reproduction Steps

1. Clone the reproducer repository: foundry-coverage-bug-reproducer
2. Run the tests: forge test
3. Run the coverage: forge coverage --report summary

Expected Behavior

Both SimpleCondition.sol and ArrayCondition.sol should show 100% branch coverage, as all branches are tested.

Actual Behavior

• SimpleCondition.sol shows 100% branch coverage

• ArrayCondition.sol shows less than 100% branch coverage, despite having tests for all branches

Minimal Test Cases

1. The reproducer repository contains two minimal test cases:
   SimpleCondition.sol: A contract with a simple numeric condition in the constructor
   • The coverage tool correctly identifies both branches
2. ArrayCondition.sol: A contract with an array length condition in the constructor
   • The coverage tool fails to identify both branches

Summary

The Foundry coverage tool fails to properly track branch coverage in constructors, particularly with array length checks. While storing array lengths in temporary variables improves coverage metrics slightly, it does not fully resolve the issue.

Conclusion
The temporary variable approach is not a true workaround but merely a partial mitigation. This suggests a fundamental issue with how the coverage tool instruments and tracks branch execution in constructors, rather than just a problem with direct array length access.

Impact

This bug affects the accuracy of coverage reports, potentially leading to false negatives in coverage checks. Developers may be misled into thinking that certain branches are not tested when they actually are.