Re: [hatari-devel] Uninitialized value errors from Valgrind

[Nicolas Pomarède <npomarede@xxxxxxxxxxxx>]

Le 02/09/2023 à 00:39, Eero Tamminen a écrit :
> Hi,
>
> While debugging some other issues (which keep me busy for now), I 
> noticed Valgrind printing a lot of uninitialized value errors for Hatari.
>
> These are from running ScummVM in emulated 32Mhz Falcon + FPU with 
> 8+64MB RAM, and DSP disabled, using latest EmuTOS git version.
>
> EmuTOS boot:
> ==5238== Conditional jump or move depends on uninitialised value(s)
> ==5238==    at 0x7FC8C9: op_6601_23_ff (cpuemu_23.c:28838)
> ==5238==    by 0x340AF0: m68k_run_2ce (newcpu.c:7036)
> ==5238==    by 0x33CDE1: m68k_go (newcpu.c:7832)
> ==5238==    by 0x2B5576: main (main.c:983)
>
> Corresponds to generated code:
>          /* OP zero */
>          if (cctrue(6)) {

Hi

due to some optimisations in cpu core, valgrind or other tools are 
sometimes reporting false positive.
Here for example it's unlikely that regflags.cznv (which is used by 
cctrue() ) is non initialised. Or maybe valgrind points to line 28838 
but it could be anything inside the 'if' ?

Perhaps compiling hatari without -O flags could avoid more optimisations 
and help valgrind give a more precise cause on the uninitialised value ?

> Then further issues from CPU core while ScummVM startup continued:
> ==5238== Conditional jump or move depends on uninitialised value(s)
> ==5238==    at 0xC1E2F4: m68k_mull (newcpu_common.c:1357)
> ==5238==    by 0x7F287B: op_4c3c_23_ff (cpuemu_23.c:21610)
> ==5238==    by 0x340AF0: m68k_run_2ce (newcpu.c:7036)
> ==5238==    by 0x33CDE1: m68k_go (newcpu.c:7832)
> ==5238==    by 0x2B5576: main (main.c:983)

here also I don't see the cause. I guess the possible variable is "a", 
but it can't be uninitialised as we have a few lines above "a *= 
(uae_s64)(uae_s32)src"

> ==5238==
> ==5238== Conditional jump or move depends on uninitialised value(s)
> ==5238==    at 0x7FD20A: op_6c00_23_ff (cpuemu_23.c:29262)
> ==5238==    by 0x340AF0: m68k_run_2ce (newcpu.c:7036)
> ==5238==    by 0x33CDE1: m68k_go (newcpu.c:7832)
> ==5238==    by 0x2B5576: main (main.c:983)

same as 1st case

> ==5238==
> ==5238== Use of uninitialised value of size 8
> ==5238==    at 0x333FAB: read_dcache030_2 (newcpu.c:10235)
> ==5238==    by 0x32F157: read_dcache030 (newcpu.c:10312)
> ==5238==    by 0x32F157: read_dcache030_bget (newcpu.c:10338)
> ==5238==    by 0x32F157: get_byte_dc030 (cpu_prefetch.h:303)
> ==5238==    by 0x7E115A: op_1130_23_ff (cpuemu_23.c:9214)
> ==5238==    by 0x340AF0: m68k_run_2ce (newcpu.c:7036)
> ==5238==    by 0x33CDE1: m68k_go (newcpu.c:7832)
> ==5238==    by 0x2B5576: main (main.c:983)

Here also I don't which of the 3 variables in 
"dcache030_maybe_burst(addr, c2, lws2)" can be uninitialised

[...]

> After which Valgrind stopped reporting additional ones, as its limit had 
> been exceeded (until I got into crash I was debugging).

Unless there's a way to have more precise detail from valgrind on which 
variables would be uninitialised, these reports look like false positive 
to me.

Nicolas