Valgrind reports uninitialised access

[mingodad]

I've just downloaded https://pike.lysator.liu.se/pub/pike/latest-stable/Pike-v8.0.1956.tar.gz and after build and install on linux and then testing with small recursive program I'm getting this output:

$>valgrind pike fibo.pyke 
==5996== Memcheck, a memory error detector
==5996== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==5996== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info
==5996== Command: pike fibo.pyke
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x80B94FD: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1CBD8B: call_pike_initializers (object.c:338)
==5996==    by 0x1CBD8B: get_master (object.c:702)
==5996==    by 0x1CC0B8: debug_master (object.c:720)
==5996==    by 0x1AE7B6: load_pike_master (pike_embed.c:397)
==5996==    by 0x120509: main (main.c:676)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x80DA2D8: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1CBD29: call_pike_initializers (object.c:345)
==5996==    by 0x1CBD29: get_master (object.c:702)
==5996==    by 0x1CC0B8: debug_master (object.c:720)
==5996==    by 0x1AE7B6: load_pike_master (pike_embed.c:397)
==5996==    by 0x120509: main (main.c:676)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x4208D41: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1C8D99: call_pike_initializers (object.c:345)
==5996==    by 0x1C9084: parent_clone_object (object.c:447)
==5996==    by 0x137449: low_mega_apply (apply_low.h:234)
==5996==    by 0x137A8D: jump_opcode_F_CALL_FUNCTION (interpret_functions.h:2452)
==5996==    by 0x420FD25: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1CBD29: call_pike_initializers (object.c:345)
==5996==    by 0x1CBD29: get_master (object.c:702)
==5996==    by 0x1CC0B8: debug_master (object.c:720)
==5996==    by 0x1AE7B6: load_pike_master (pike_embed.c:397)
==5996==    by 0x120509: main (main.c:676)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x4210EE3: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1CB755: object_index_no_free (object.c:1534)
==5996==    by 0x133E84: opcode_F_LOCAL_INDEX (interpret_functions.h:2078)
==5996==    by 0x80BB17B: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x120537: main (main.c:681)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x80BCBFD: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x120537: main (main.c:681)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x80D2F4E: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x1D4965: o_cast (operators.c:700)
==5996==    by 0x1D5D2B: f_cast (operators.c:946)
==5996==    by 0x80E7EDD: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x120537: main (main.c:681)
==5996== 
==5996== Conditional jump or move depends on uninitialised value(s)
==5996==    at 0x80BCBFD: ???
==5996==    by 0x139FE7: eval_instruction (interpret.c:1816)
==5996==    by 0x139FE7: mega_apply_low (interpret.c:2828)
==5996==    by 0x137E71: lower_mega_apply (interpret.c:2279)
==5996==    by 0x139FCD: mega_apply_low (interpret.c:2826)
==5996==    by 0x13C369: apply_external (interpret.c:3308)
==5996==    by 0x137E71: lower_mega_apply (interpret.c:2279)
==5996==    by 0x139FCD: mega_apply_low (interpret.c:2826)
==5996==    by 0x13B2E0: safe_apply_low2 (interpret.c:3076)
==5996==    by 0x1F7B27: run_init2 (program.c:9024)
==5996==    by 0x1F8077: run_pass1 (program.c:9137)
==5996==    by 0x1F8077: f_compilation_compile (program.c:9723)
==5996==    by 0x137E71: lower_mega_apply (interpret.c:2279)
==5996==    by 0x139FCD: mega_apply_low (interpret.c:2826)
==5996== 
Result of 32 = 3524578
==5996== 
==5996== HEAP SUMMARY:
==5996==     in use at exit: 1,410,599 bytes in 806 blocks
==5996==   total heap usage: 28,336 allocs, 27,530 frees, 41,877,281 bytes allocated
==5996== 
==5996== LEAK SUMMARY:
==5996==    definitely lost: 0 bytes in 0 blocks
==5996==    indirectly lost: 0 bytes in 0 blocks
==5996==      possibly lost: 0 bytes in 0 blocks
==5996==    still reachable: 1,410,599 bytes in 806 blocks
==5996==         suppressed: 0 bytes in 0 blocks
==5996== Rerun with --leak-check=full to see details of leaked memory
==5996== 
==5996== Use --track-origins=yes to see where uninitialised values come from
==5996== For lists of detected and suppressed errors, rerun with: -s
==5996== ERROR SUMMARY: 175 errors from 7 contexts (suppressed: 0 from 0)

here is the fibo.pyke :

int fib(int n)
{
    if (n < 2) return 1;
    return fib(n-2) + fib(n-1);
}

int main(int argc, array argv)
{
    int xt = 32;
    int result = fib(xt);
    write("Result of %d = %d\n", xt, result);
    return 0;
}

[grubba]

This looks like a classic false positive that valgrind generates for C-code like

struct foo {
  short a;
  short b;
};

void test(struct foo *f)
{
   if ((f->a == 1) && (f->b == 2)) {
     // Do something special.
  }
}

int main(int argc, char **argv)
{
   foo A;
   foo B;

  A.a = 0;
  B.a = 1;
  B.b = 2;

  test(&A);
  test(&B);
}

Gcc will typically optimize the test in test() above into something similar to

  if (*((int*)f) == 0x00010002) {
    // Do something special.
  }

The above is valid code (as f->b will always be initialized when f->a is 1), but Valgrind will complain about the test when f->b is uninitialized even if f->a is not 1.

Try compiling your Pike without optimizations and see if the valgrind complaint persists. All of the complaints in your report appear to come from interpret.c:eval_instruction(), so it should be sufficient to recompile that file without optimization.

You may also want to configure pike --with-valgrind.

[mingodad]

I've rebuilt it with CFLAGS="-g -O0" make CONFIGUREARGS="--prefix=$HOME/local" and the problem remain.

$>valgrind ./pike fibo.pyke
==14710== Memcheck, a memory error detector
==14710== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==14710== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info
==14710== Command: ./pike fibo.pyke
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x80B94FD: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x1EE8FA: call_pike_initializers (object.c:338)
==14710==    by 0x1EF98F: get_master (object.c:702)
==14710==    by 0x1EFA41: debug_master (object.c:720)
==14710==    by 0x1D452D: load_pike_master (pike_embed.c:397)
==14710==    by 0x120EF8: main (main.c:676)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x80DA2D8: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x1EE93E: call_pike_initializers (object.c:345)
==14710==    by 0x1EF98F: get_master (object.c:702)
==14710==    by 0x1EFA41: debug_master (object.c:720)
==14710==    by 0x1D452D: load_pike_master (pike_embed.c:397)
==14710==    by 0x120EF8: main (main.c:676)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x4208D41: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x1EE93E: call_pike_initializers (object.c:345)
==14710==    by 0x1EEE31: parent_clone_object (object.c:447)
==14710==    by 0x144109: low_mega_apply (apply_low.h:234)
==14710==    by 0x13E730: jump_opcode_F_CALL_FUNCTION (interpret_functions.h:2452)
==14710==    by 0x420FD25: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x1EE93E: call_pike_initializers (object.c:345)
==14710==    by 0x1EF98F: get_master (object.c:702)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x4210EE3: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x146E9B: apply_lfun (interpret.c:3230)
==14710==    by 0x1F20D6: object_index_no_free (object.c:1534)
==14710==    by 0x1F9A97: index_no_free (operators.c:79)
==14710==    by 0x13CB7A: opcode_F_LOCAL_INDEX (interpret_functions.h:2078)
==14710==    by 0x80BB17B: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x146F4E: apply (interpret.c:3248)
==14710==    by 0x120F3F: main (main.c:681)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x80BCBFD: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x146F4E: apply (interpret.c:3248)
==14710==    by 0x120F3F: main (main.c:681)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x80D2F4E: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x1FC0AE: o_cast (operators.c:700)
==14710==    by 0x1FD911: f_cast (operators.c:946)
==14710==    by 0x80E7EDD: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x146F4E: apply (interpret.c:3248)
==14710==    by 0x120F3F: main (main.c:681)
==14710== 
==14710== Conditional jump or move depends on uninitialised value(s)
==14710==    at 0x80BCBFD: ???
==14710==    by 0x141F0E: eval_instruction (interpret.c:1816)
==14710==    by 0x1457A1: mega_apply_low (interpret.c:2828)
==14710==    by 0x226321: f_compilation_env_get_default_module (program.c:8846)
==14710==    by 0x142E88: lower_mega_apply (interpret.c:2279)
==14710==    by 0x145781: mega_apply_low (interpret.c:2826)
==14710==    by 0x14746D: apply_external (interpret.c:3308)
==14710==    by 0x228A4C: f_compilation_get_default_module (program.c:9860)
==14710==    by 0x142E88: lower_mega_apply (interpret.c:2279)
==14710==    by 0x145781: mega_apply_low (interpret.c:2826)
==14710==    by 0x1464FF: safe_apply_low2 (interpret.c:3076)
==14710==    by 0x226B0D: run_init2 (program.c:9024)
==14710== 
Result of 32 = 3524578
==14710== 
==14710== HEAP SUMMARY:
==14710==     in use at exit: 1,410,755 bytes in 808 blocks
==14710==   total heap usage: 28,334 allocs, 27,526 frees, 41,876,768 bytes allocated
==14710== 
==14710== LEAK SUMMARY:
==14710==    definitely lost: 0 bytes in 0 blocks
==14710==    indirectly lost: 0 bytes in 0 blocks
==14710==      possibly lost: 0 bytes in 0 blocks
==14710==    still reachable: 1,410,755 bytes in 808 blocks
==14710==         suppressed: 0 bytes in 0 blocks
==14710== Rerun with --leak-check=full to see details of leaked memory
==14710== 
==14710== Use --track-origins=yes to see where uninitialised values come from
==14710== For lists of detected and suppressed errors, rerun with: -s
==14710== ERROR SUMMARY: 175 errors from 7 contexts (suppressed: 0 from 0)

[mingodad]

When I build it with CFLAGS="-g -O0" make CONFIGUREARGS="--prefix=$HOME/local --with-valgrind" then valgrind report nothing, but because I don't know what '--with-valgrind' is doing (at glance I saw some declarations that seems to only be activated with it) I'm still more inclined that this is a memory problem.

[grubba]

--with-valgrind inits several fields (even when not strictly necessary), ensures that memory is freed properly on exit and adds hints to valgrind about memory being freed.

[mingodad]

Thanks for reply !
Then it seems to be a memory issue.

[mingodad]

And testing with the sample shown bellow is enough for valgrind to report the problem.

int main(int argc, array argv)
{
    return 0;
}

[grubba]

I can not reproduce the issue with current Pike 8.0:

$ ../../src/configure --with-valgrind --without-copt
[...]
$ make
[...]
$ cat github67.pike 
int main(int argc, array argv)
{
    return 0;
}
$ valgrind ./pike ./github67.pike 
==13850== Memcheck, a memory error detector
==13850== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==13850== Using Valgrind-3.26.0 and LibVEX; rerun with -h for copyright info
==13850== Command: ./pike ./github67.pike
==13850== 
==13850== LEAK SUMMARY:
==13850==    definitely lost: 0 bytes in 0 blocks
==13850==    indirectly lost: 0 bytes in 0 blocks
==13850==      possibly lost: 0 bytes in 0 blocks
==13850==    still reachable: 709,787 bytes in 36 blocks
==13850==         suppressed: 0 bytes in 0 blocks
==13850== Reachable blocks (those to which a pointer was found) are not shown.
==13850== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==13850== 
==13850== 
==13850== HEAP SUMMARY:
==13850==     in use at exit: 14 bytes in 1 blocks
==13850==   total heap usage: 27,492 allocs, 27,491 frees, 41,982,864 bytes allocated
==13850== 
==13850== LEAK SUMMARY:
==13850==    definitely lost: 0 bytes in 0 blocks
==13850==    indirectly lost: 0 bytes in 0 blocks
==13850==      possibly lost: 0 bytes in 0 blocks
==13850==    still reachable: 14 bytes in 1 blocks
==13850==         suppressed: 0 bytes in 0 blocks
==13850== Rerun with --leak-check=full to see details of leaked memory
==13850== 
==13850== For lists of detected and suppressed errors, rerun with: -s
==13850== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[mingodad]

It seems that Pike is not showing minor version, probably it's a good idea to add minor version to help give a better report, as I said my build is based on a fresh download from +- 6 hours ago from https://pike.lysator.liu.se/pub/pike/latest-stable/Pike-v8.0.1956.tar.gz, where did you've got your ?

pike --version
Pike v8.0 release 1956 Copyright © 1994-2025 Linköping University
Pike comes with ABSOLUTELY NO WARRANTY; This is free software and you are
welcome to redistribute it under certain conditions; read the files
COPYING and COPYRIGHT in the Pike distribution for more details.

[mingodad]

Now I see, you are using --valgrind to build, try to build without it CFLAGS="-g -O0" make

[grubba]

Building without it is meaningless as it will trigger known false positives.

[mingodad]

I'm not sure about your claim.

[grubba]

The whole reason for --with-valgrind is to get rid of false positives.