Problem report #90

Problem report #90

[Dan Nicolaescu]

CID: 90
Checker: UNINIT (help)
File: base/src/emacs/src/eval.c
Function: Ffuncall
Description: Using uninitialized value "val"

Event var_decl: Declared variable "val" without initializer
Also see events: [uninit_use]

2839 	  Lisp_Object val;
2840 	  struct backtrace backtrace;
2841 	  register Lisp_Object *internal_args;
2842 	  register int i;
2843 	
2844 	  QUIT;
2845 	  if ((consing_since_gc > gc_cons_threshold
2846 	       && consing_since_gc > gc_relative_threshold)
2847 	      ||
2848 	      (!NILP (Vmemory_full) && consing_since_gc > memory_full_cons_threshold))
2849 	    Fgarbage_collect ();
2850 	
2851 	  if (++lisp_eval_depth > max_lisp_eval_depth)
2852 	    {
2853 	      if (max_lisp_eval_depth < 100)
2854 		max_lisp_eval_depth = 100;
2855 	      if (lisp_eval_depth > max_lisp_eval_depth)
2856 		error ("Lisp nesting exceeds `max-lisp-eval-depth'");
2857 	    }
2858 	
2859 	  backtrace.next = backtrace_list;
2860 	  backtrace_list = &backtrace;
2861 	  backtrace.function = &args[0];
2862 	  backtrace.args = &args[1];
2863 	  backtrace.nargs = nargs - 1;
2864 	  backtrace.evalargs = 0;
2865 	  backtrace.debug_on_exit = 0;
2866 	
2867 	  if (debug_on_next_call)
2868 	    do_debug_on_call (Qlambda);
2869 	
2870 	  CHECK_CONS_LIST ();
2871 	
2872 	  original_fun = args[0];
2873 	
2874 	 retry:
2875 	
2876 	  /* Optimize for no indirection.  */
2877 	  fun = original_fun;

At conditional (9): "fun & 7 == 1" taking true path
At conditional (10): "fun != Qunbound" taking true path
At conditional (11): "(fun = ((0), (fun & -8))->function), (fun & 7 == 1)" taking true path

2878 	  if (SYMBOLP (fun) && !EQ (fun, Qunbound)
2879 	      && (fun = XSYMBOL (fun)->function, SYMBOLP (fun)))
2880 	    fun = indirect_function (fun);
2881 	

At conditional (1): "((0), (fun & -8))->size & 1073758208 == 1073758208" taking false path
At conditional (12): "fun & 7 == 4" taking true path
At conditional (13): "((0), (fun & -8))->size & 1073758208 == 1073758208" taking false path

2882 	  if (SUBRP (fun))
2883 	    {
2884 	       if (numargs < XSUBR (fun)->min_args
2885 		  || (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args < numargs))
2886 		{
2887 		  XSETFASTINT (lisp_numargs, numargs);
2888 		  Fsignal (Qwrong_number_of_arguments, list2 (original_fun, lisp_numargs));
2889 		}
2890 	
2891 	      if (XSUBR (fun)->max_args == UNEVALLED)
2892 		Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2893 	
2894 	      if (XSUBR (fun)->max_args == MANY)
2895 		{
2896 		  val = (*XSUBR (fun)->function) (numargs, args + 1);
2897 		  goto done;
2898 		}
2899 	
2900 	      if (XSUBR (fun)->max_args > numargs)
2901 		{
2902 		  internal_args = (Lisp_Object *) alloca (XSUBR (fun)->max_args * sizeof (Lisp_Object));
2903 		  bcopy (args + 1, internal_args, numargs * sizeof (Lisp_Object));
2904 		  for (i = numargs; i < XSUBR (fun)->max_args; i++)
2905 		    internal_args[i] = Qnil;
2906 		}
2907 	      else
2908 		internal_args = args + 1;
2909 	      switch (XSUBR (fun)->max_args)
2910 		{
2911 		case 0:
2912 		  val = (*XSUBR (fun)->function) ();
2913 		  goto done;
2914 		case 1:
2915 		  val = (*XSUBR (fun)->function) (internal_args[0]);
2916 		  goto done;
2917 		case 2:
2918 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1]);
2919 		  goto done;
2920 		case 3:
2921 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2922 						  internal_args[2]);
2923 		  goto done;
2924 		case 4:
2925 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2926 						  internal_args[2], internal_args[3]);
2927 		  goto done;
2928 		case 5:
2929 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2930 						  internal_args[2], internal_args[3],
2931 						  internal_args[4]);
2932 		  goto done;
2933 		case 6:
2934 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2935 						  internal_args[2], internal_args[3],
2936 						  internal_args[4], internal_args[5]);
2937 		  goto done;
2938 		case 7:
2939 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2940 						  internal_args[2], internal_args[3],
2941 						  internal_args[4], internal_args[5],
2942 						  internal_args[6]);
2943 		  goto done;
2944 	
2945 		case 8:
2946 		  val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
2947 						  internal_args[2], internal_args[3],
2948 						  internal_args[4], internal_args[5],
2949 						  internal_args[6], internal_args[7]);
2950 		  goto done;
2951 	
2952 		default:
2953 	
2954 		  /* If a subr takes more than 8 arguments without using MANY
2955 		     or UNEVALLED, we need to extend this function to support it.
2956 		     Until this is done, there is no way to call the function.  */
2957 		  abort ();
2958 		}
2959 	    }

At conditional (2): "fun & 7 == 4" taking true path
At conditional (3): "((0), (fun & -8))->size & 1073743872 == 1073743872" taking false path
At conditional (14): "fun & 7 == 4" taking true path
At conditional (15): "((0), (fun & -8))->size & 1073743872 == 1073743872" taking false path

2960 	  if (COMPILEDP (fun))
2961 	    val = funcall_lambda (fun, numargs, args + 1);
2962 	  else
2963 	    {

At conditional (4): "fun == Qunbound" taking true path
At conditional (16): "fun == Qunbound" taking true path

2964 	      if (EQ (fun, Qunbound))
2965 		Fsignal (Qvoid_function, Fcons (original_fun, Qnil));

At conditional (5): "fun & 7 != 5" taking true path
At conditional (17): "fun & 7 != 5" taking true path

2966 	      if (!CONSP (fun))
2967 		Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2968 	      funcar = Fcar (fun);

At conditional (6): "funcar & 7 != 1" taking true path
At conditional (18): "funcar & 7 != 1" taking true path

2969 	      if (!SYMBOLP (funcar))
2970 		Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));

At conditional (7): "funcar == Qlambda" taking false path
At conditional (19): "funcar == Qlambda" taking false path

2971 	      if (EQ (funcar, Qlambda))
2972 		val = funcall_lambda (fun, numargs, args + 1);

At conditional (8): "funcar == Qautoload" taking true path
At conditional (20): "funcar == Qautoload" taking false path

2973 	      else if (EQ (funcar, Qautoload))
2974 		{
2975 		  do_autoload (fun, original_fun);
2976 		  CHECK_CONS_LIST ();
2977 		  goto retry;
2978 		}
2979 	      else
2980 		Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2981 	    }
2982 	 done:
2983 	  CHECK_CONS_LIST ();
2984 	  lisp_eval_depth--;

At conditional (21): "(backtrace).debug_on_exit != 0" taking false path

2985 	  if (backtrace.debug_on_exit)
2986 	    val = call_debugger (Fcons (Qexit, Fcons (val, Qnil)));
2987 	  backtrace_list = backtrace.next;

Event uninit_use: Using uninitialized value "val"
Also see events: [var_decl]

2988 	  return val;
2989 	}

Re: Problem report #90

[Andreas Schwab]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> 2960 	  if (COMPILEDP (fun))
> 2961 	    val = funcall_lambda (fun, numargs, args + 1);
> 2962 	  else
> 2963 	    {
>
> At conditional (4): "fun == Qunbound" taking true path
> At conditional (16): "fun == Qunbound" taking true path
>
> 2964 	      if (EQ (fun, Qunbound))
> 2965 		Fsignal (Qvoid_function, Fcons (original_fun, Qnil));

Since Fsignal does not return the true path here and similar paths below
are uninteresting.  With this premise there is always an assignment to
val.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: Problem report #90

[Miles Bader]

Andreas Schwab <schwab@suse.de> writes:
> Since Fsignal does not return the true path here and similar paths below
> are uninteresting.  With this premise there is always an assignment to
> val.

I guess this has probably been discussed before, but why aren't
functions like Fsignal annotated as never returning?

[At least when using gcc.]

-Miles
-- 
Run away!  Run away!

Re: Problem report #90

[Stefan Monnier]

>> Since Fsignal does not return the true path here and similar paths below
>> are uninteresting.  With this premise there is always an assignment
>> to val.

> I guess this has probably been discussed before, but why aren't
> functions like Fsignal annotated as never returning?

See Kim's recent patch that introduce xsignal.

The problem which that patch solves is that Fsignal sometimes can return (if
signalling a `quit'), so it's incorrect to annotate it as never returning.


        Stefan