valgrind emacs

valgrind emacs

[Neal Becker]

Anyone try valgrind on emacs?  I get some errors:
==15930== Invalid free() / delete / delete[]
==15930==    at 0x4A05AF7: realloc (vg_replace_malloc.c:306)
==15930==    by 0x536A0D: xrealloc (alloc.c:788)
==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
==15930==    by 0x4701B1: produce_chars (coding.c:6068)
==15930==    by 0x4750ED: decode_coding (coding.c:6403)
==15930==    by 0x476326: decode_coding_object (coding.c:7054)
==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
==15930==    by 0x4DC268: main (emacs.c:555)
==15930==  Address 0x256FB60 is not stack'd, malloc'd or (recently) free'd
==15930== 
==15930== Invalid free() / delete / delete[]
==15930==    at 0x4A0560B: free (vg_replace_malloc.c:233)
==15930==    by 0x53465B: memory_full (alloc.c:3416)
==15930==    by 0x536A24: xrealloc (alloc.c:791)
==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
==15930==    by 0x4701B1: produce_chars (coding.c:6068)
==15930==    by 0x4750ED: decode_coding (coding.c:6403)
==15930==    by 0x476326: decode_coding_object (coding.c:7054)
==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
==15930==    by 0x4DC268: main (emacs.c:555)
==15930==  Address 0x24E85E0 is not stack'd, malloc'd or (recently) free'd
==15930== 
==15930== Invalid free() / delete / delete[]
==15930==    at 0x4A0560B: free (vg_replace_malloc.c:233)
==15930==    by 0x534284: lisp_align_free (alloc.c:1112)
==15930==    by 0x53461A: memory_full (alloc.c:3418)
==15930==    by 0x536A24: xrealloc (alloc.c:791)
==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
==15930==    by 0x4701B1: produce_chars (coding.c:6068)
==15930==    by 0x4750ED: decode_coding (coding.c:6403)
==15930==    by 0x476326: decode_coding_object (coding.c:7054)
==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
==15930==    by 0x4DC268: main (emacs.c:555)
==15930==  Address 0x24E84D0 is not stack'd, malloc'd or (recently) free'd
==15930== 
==15930== Invalid free() / delete / delete[]
==15930==    at 0x4A0560B: free (vg_replace_malloc.c:233)
==15930==    by 0x534328: lisp_free (alloc.c:899)
==15930==    by 0x534654: memory_full (alloc.c:3420)
==15930==    by 0x536A24: xrealloc (alloc.c:791)
==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
==15930==    by 0x4701B1: produce_chars (coding.c:6068)
==15930==    by 0x4750ED: decode_coding (coding.c:6403)
==15930==    by 0x476326: decode_coding_object (coding.c:7054)
==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
==15930==    by 0x4DC268: main (emacs.c:555)
==15930==  Address 0x24F0680 is not stack'd, malloc'd or (recently) free'd
==15930== 
==15930== Invalid free() / delete / delete[]
==15930==    at 0x4A0560B: free (vg_replace_malloc.c:233)
==15930==    by 0x534654: memory_full (alloc.c:3420)
==15930==    by 0x536A24: xrealloc (alloc.c:791)
==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
==15930==    by 0x4701B1: produce_chars (coding.c:6068)
==15930==    by 0x4750ED: decode_coding (coding.c:6403)
==15930==    by 0x476326: decode_coding_object (coding.c:7054)
==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
==15930==    by 0x4DC268: main (emacs.c:555)
==15930==  Address 0x24F0EA0 is not stack'd, malloc'd or (recently) free'd
emacs: Memory exhausted--use M-x save-some-buffers then exit and restart Emacs==15930== 
==15930== ERROR SUMMARY: 10 errors from 5 contexts (suppressed: 4 from 1)
==15930== malloc/free: in use at exit: 80 bytes in 4 blocks.
==15930== malloc/free: 105 allocs, 110 frees, 10,956 bytes allocated.
==15930== For counts of detected errors, rerun with: -v
==15930== searching for pointers to 4 not-freed blocks.
==15930== checked 51,884,776 bytes.
==15930== 

Re: valgrind emacs

[Chong Yidong]

Neal Becker <ndbecker2@gmail.com> writes:

> Anyone try valgrind on emacs?  I get some errors:
> ==15930== Invalid free() / delete / delete[]
> ==15930==    at 0x4A05AF7: realloc (vg_replace_malloc.c:306)
> ==15930==    by 0x536A0D: xrealloc (alloc.c:788)
> ==15930==    by 0x4F9DBF: enlarge_buffer_text (buffer.c:5095)
> ==15930==    by 0x50458B: make_gap_larger (insdel.c:528)
> ==15930==    by 0x46FE5B: alloc_destination (coding.c:1124)
> ==15930==    by 0x4701B1: produce_chars (coding.c:6068)
> ==15930==    by 0x4750ED: decode_coding (coding.c:6403)
> ==15930==    by 0x476326: decode_coding_object (coding.c:7054)
> ==15930==    by 0x476AF8: code_convert_string (coding.c:8281)
> ==15930==    by 0x4DC268: main (emacs.c:555)
> ==15930==  Address 0x256FB60 is not stack'd, malloc'd or (recently) free'd

I don't see how this code path could occur.  This seems to be
complaining that b->text->beg in enlarge_buffer_text (buffer.c:5095)
is not a malloc'ed pointer.  But this code path is only activated when
BUFFERP (coding->dst_object) in alloc_destination (buffer.c:1142).
Which means that we already have a valid buffer.

I haven't used valgrind before, so I don't know how reliable it is.
Does anyone know how easy it is to confuse it?

(I haven't studied the rest of the errors closely, but they seem to be
of the same variety.)

Re: valgrind emacs

[Andreas Schwab]

Neal Becker <ndbecker2@gmail.com> writes:

> Anyone try valgrind on emacs?  I get some errors:
> ==15930== Invalid free() / delete / delete[]
> ==15930==    at 0x4A05AF7: realloc (vg_replace_malloc.c:306)

valgrind depends on its own implementation of malloc that is unlikely to
understand the internal malloc state from glibc's malloc which is
installed by malloc_set_state.  Thus for proper results you must run
valgrind on temacs.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: valgrind emacs

[Neal Becker]

Andreas Schwab wrote:

> Neal Becker <ndbecker2@gmail.com> writes:
> 
>> Anyone try valgrind on emacs?  I get some errors:
>> ==15930== Invalid free() / delete / delete[]
>> ==15930==    at 0x4A05AF7: realloc (vg_replace_malloc.c:306)
> 
> valgrind depends on its own implementation of malloc that is unlikely to
> understand the internal malloc state from glibc's malloc which is
> installed by malloc_set_state.  Thus for proper results you must run
> valgrind on temacs.
> 
> Andreas.
> 
OK:
valgrind ~/RPM/BUILD/emacs-23.0.60/src/temacs
==3816== Conditional jump or move depends on uninitialised value(s)
==3816==    at 0x4D68E5: Fgarbage_collect (alloc.c:5004)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
==3816==    by 0x4856A9: top_level_1 (keyboard.c:1387)
==3816==    by 0x4EAD26: internal_catch (eval.c:1230)
==3816==    by 0x48616E: command_loop (keyboard.c:1342)
==3816== 
==3816== Conditional jump or move depends on uninitialised value(s)
==3816==    at 0x4D2A17: mem_find (alloc.c:3510)
==3816==    by 0x4D36F4: mark_maybe_object (alloc.c:4108)
==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
...
==3816== Conditional jump or move depends on uninitialised value(s)
==3816==    at 0x4D3709: mark_maybe_object (alloc.c:4114)
==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
==3816==    by 0x4856A9: top_level_1 (keyboard.c:1387)
...
==3816== Conditional jump or move depends on uninitialised value(s)
==3816==    at 0x4D2B9A: live_cons_p (alloc.c:3926)
==3816==    by 0x4D37D4: mark_maybe_object (alloc.c:4122)
==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
...
==3816== Use of uninitialised value of size 8
==3816==    at 0x4D37FE: mark_maybe_object (alloc.c:4122)
==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
==3816==    by 0x4856A9: top_level_1 (keyboard.c:1387)
...
==3816== Conditional jump or move depends on uninitialised value(s)
==3816==    at 0x4D2F82: mark_object (alloc.c:5376)
==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
==3816==    by 0x4EB922: Feval (eval.c:2248)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x5047BB: readevalloop (lread.c:1791)
==3816==    by 0x50614D: Fload (lread.c:1255)
==3816==    by 0x4EBB5E: Feval (eval.c:2370)
==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
==3816==    by 0x4856A9: top_level_1 (keyboard.c:1387)
...
lots more, not all the same...

Re: valgrind emacs

[Stefan Monnier]

> ==3816== Conditional jump or move depends on uninitialised value(s)
> ==3816==    at 0x4D68E5: Fgarbage_collect (alloc.c:5004)
> ==3816==    by 0x4EB922: Feval (eval.c:2248)
> ==3816==    by 0x5047BB: readevalloop (lread.c:1791)
> ==3816==    by 0x50614D: Fload (lread.c:1255)
> ==3816==    by 0x4EBB5E: Feval (eval.c:2370)
> ==3816==    by 0x5047BB: readevalloop (lread.c:1791)
> ==3816==    by 0x50614D: Fload (lread.c:1255)
> ==3816==    by 0x4EBB5E: Feval (eval.c:2370)
> ==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)
> ==3816==    by 0x4856A9: top_level_1 (keyboard.c:1387)
> ==3816==    by 0x4EAD26: internal_catch (eval.c:1230)
> ==3816==    by 0x48616E: command_loop (keyboard.c:1342)

No idea what this is about.  Might be an actual bug.

> ==3816== Conditional jump or move depends on uninitialised value(s)
> ==3816==    at 0x4D2A17: mem_find (alloc.c:3510)
> ==3816==    by 0x4D36F4: mark_maybe_object (alloc.c:4108)
> ==3816==    by 0x4D392D: mark_stack (alloc.c:4272)
> ==3816==    by 0x4D6A55: Fgarbage_collect (alloc.c:5092)
> ==3816==    by 0x4EB922: Feval (eval.c:2248)
> ==3816==    by 0x5047BB: readevalloop (lread.c:1791)
> ==3816==    by 0x50614D: Fload (lread.c:1255)
> ==3816==    by 0x4EBB5E: Feval (eval.c:2370)
> ==3816==    by 0x5047BB: readevalloop (lread.c:1791)
> ==3816==    by 0x50614D: Fload (lread.c:1255)
> ==3816==    by 0x4EBB5E: Feval (eval.c:2370)
> ==3816==    by 0x4EAC36: internal_condition_case (eval.c:1494)

Most likely a non-issue: the conservative stack-scanning will look at
all slots in the stack, and of course some of those may not have
been initialized.  But the arbitrary values read off the stack are
sanity-checked so that they're ignored unless they do correspond to
valid Lisp pointers.  Maybe they're not really Lisp pointers, so the
behavior may be affected by the uninitialized value, but the only effect
it should have is to prevent garbage collection of some Lisp objects,
i.e. increase the memory footprint.


        Stefan