Bug 427510 - Use of uninitialized value in callgrind_annotate.
Summary: Use of uninitialized value in callgrind_annotate.
Status: REPORTED
Alias: None
Product: valgrind
Classification: Developer tools
Component: callgrind (show other bugs)
Version: unspecified
Platform: Gentoo Packages Linux
: NOR normal
Target Milestone: ---
Assignee: Josef Weidendorfer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-10-10 11:15 UTC by Ulya Trofimovich
Modified: 2021-02-21 12:53 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Input to callgrind_annotate. (58.92 KB, text/plain)
2020-10-10 11:15 UTC, Ulya Trofimovich
Details
Patch that fixes the bug. (1.29 KB, patch)
2020-10-13 22:15 UTC, Ulya Trofimovich
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ulya Trofimovich 2020-10-10 11:15:43 UTC
Created attachment 132259 [details]
Input to callgrind_annotate.

STEPS TO REPRODUCE

1. Run callgring_annotate on input file callgrind.out.9703 (attached):
$ callgrind_annotate callgrind.out.9703 > /dev/null

OBSERVED RESULT

Outputs the following lines on stderr:

Use of uninitialized value $pairs[0] in numeric lt (<) at /usr/bin/callgrind_annotate line 1199.
Use of uninitialized value $high in numeric lt (<) at /usr/bin/callgrind_annotate line 1210.

EXPECTED RESULT

Empty stderr.

SOFTWARE/OS VERSIONS

$ callgrind_annotate --version
callgrind_annotate-3.16.0.GIT

ADDITIONAL INFORMATION

This doesn't prevent me from using callgrind_annotate, but reporting just in case.
Comment 1 Philippe Waroquiers 2020-10-10 16:00:14 UTC
Seems fixed in recent git version.
Can you try with the last 3.16 version (or the last GIT version), 
instead of a 3.16 GIT version ?
Comment 2 Ulya Trofimovich 2020-10-10 20:33:07 UTC
(In reply to Philippe Waroquiers from comment #1)
> Seems fixed in recent git version.
> Can you try with the last 3.16 version (or the last GIT version), 
> instead of a 3.16 GIT version ?

Tried with HEAD (cloned from https://github.com/rantoniello/valgrind and built as `autogen.sh && mkdir build && cd build && ../configure && make`), the error is gone, but on a closer look it's only because the default settings have been changed. I can still see the bug with `--auto-yes`, along with some more errors:

$ callgrind_annotate --auto=yes callgrind.out.9703 >/dev/null
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 58.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 68.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 14.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 20.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 34.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 44.
Negative repeat count does nothing at callgrind_annotate line 828, <INPUTFILE> line 51.
Use of uninitialized value $pairs[0] in numeric lt (<) at callgrind_annotate line 1139.
Use of uninitialized value $high in numeric lt (<) at callgrind_annotate line 1150.

On a side note, why are annotations are off by default now? They are so useful. And the percent count is gone, I miss that one too and don't know how to get it back. :)
Comment 3 Ulya Trofimovich 2020-10-10 23:51:02 UTC
The "uninitilized" error is simple: the code assumes nonempty array and sets its first element (in the case of a zero-sized array it adds one element, which causes the second error because the assumption that there is an even number of elements in the array is broken). The following simple patch fixes the error:

diff --git a/callgrind/callgrind_annotate.in b/callgrind/callgrind_annotate.in
index 4f28129..42a8cd1 100644
--- a/callgrind/callgrind_annotate.in
+++ b/callgrind/callgrind_annotate.in
@@ -1136,7 +1136,9 @@ sub annotate_ann_files($)
             }
 
             # Annotate chosen lines, tracking total counts of lines printed
-            $pairs[0] = 1 if ($pairs[0] < 1);
+            if ($n > 0 && $pairs[0] < 1) {
+                $pairs[0] = 1
+            }
             while (@pairs) {
                 my $low  = shift @pairs;
                 my $high = shift @pairs;
Comment 4 Paul Floyd 2020-10-13 14:02:33 UTC
(In reply to Ulya Trofimovich from comment #2)
> (In reply to Philippe Waroquiers from comment #1)
> > Seems fixed in recent git version.
> > Can you try with the last 3.16 version (or the last GIT version), 
> > instead of a 3.16 GIT version ?
> 
> Tried with HEAD (cloned from https://github.com/rantoniello/valgrind and

See here instructions for building from the official Valgrind git repo.

https://www.valgrind.org/downloads/repository.html
Comment 5 Ulya Trofimovich 2020-10-13 22:15:08 UTC
Created attachment 132336 [details]
Patch that fixes the bug.
Comment 6 Ulya Trofimovich 2020-10-13 22:17:47 UTC
(In reply to Ulya Trofimovich from comment #2)
> See here instructions for building from the official Valgrind git repo.
> 
> https://www.valgrind.org/downloads/repository.html

Oh, sorry, I used the wrong git repo in comment #3. Following the above build instructions, I still get the same errors. They are trivial to fix, I attach a patch in comment #4.
Comment 7 Mark Wielaard 2021-02-21 12:26:21 UTC
I cannot replicate this issue, not even with the attachment 132259 [details]:

$ callgrind_annotate callgrind.out.9703 > /dev/null

Produces no warnings or errors.
Comment 8 Ulya Trofimovich 2021-02-21 12:53:41 UTC
(In reply to Mark Wielaard from comment #7)
> I cannot replicate this issue, not even with the attachment 132259 [details]:
> 
> $ callgrind_annotate callgrind.out.9703 > /dev/null
> 
> Produces no warnings or errors.

It could be because some of the source files needed for annotation are missing (if you drop redirection to /dev/null, there is a message "The following files chosen for auto-annotation could not be found" in the output). Now that I no longer have those files on my system I cannot reproduce the warnings (neither with HEAD, nor with the commit on which I based the patch).

But the code hasn't changed and the issue is still there: at callgrind_annotate.in:1199 "pairs[0]" could not exist if "n" is 0.