Bug 88538

Summary:	Conditional jump depends on uninitialised value testing record2x-paint.svg12.argb32
Product:	cairo	Reporter:	Massimo <sixtysix>
Component:	svg backend	Assignee:	Emmanuel Pacaud <emmanuel.pacaud>
Status:	RESOLVED MOVED	QA Contact:	cairo-bugs mailing list <cairo-bugs>
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Massimo 2015-01-17 16:47:34 UTC

valgrind reports

>==2== Conditional jump or move depends on uninitialised value(s)
>==2==    at 0x4C740B9: _cairo_recording_surface_merge_source_attributes.isra.8 (cairo/src/cairo-recording-surface.c:1628)
>==2==    by 0x4C7484B: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1865)
>==2==    by 0x4C75A4E: _cairo_recording_surface_replay_and_create_regions (cairo/src/cairo-recording-surface.c:2029)
>==2==    by 0x4C56B2D: _paint_page (cairo/src/cairo-paginated-surface.c:356)
>==2==    by 0x4C56F4C: _cairo_paginated_surface_show_page (cairo/src/cairo-paginated-surface.c:509)
>==2==    by 0x4C57057: _cairo_paginated_surface_finish (cairo/src/cairo-paginated-surface.c:204)
>==2==    by 0x4C81C7D: _cairo_surface_finish (cairo/src/cairo-surface.c:1030)
>==2==    by 0x4C828CE: cairo_surface_finish (cairo/src/cairo-surface.c:1077)
>==2==    by 0x46BB87: _cairo_boilerplate_svg_finish_surface (cairo/boilerplate/cairo-boilerplate-svg.c:184)
>==2==    by 0x4185B5: cairo_test_for_target (cairo/test/cairo-test.c:994)
>==2==    by 0x4185B5: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532)
>==2==    by 0x415955: _cairo_test_runner_draw (cairo/test/cairo-test-runner.c:255)
>==2==    by 0x415955: main (cairo/test/cairo-test-runner.c:937)
>==2==  Uninitialised value was created by a heap allocation
>==2==    at 0x4A06BCF: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
>==2==    by 0x4C73760: _cairo_recording_surface_snapshot (cairo/src/cairo-recording-surface.c:1427)
>==2==    by 0x4C885B3: _cairo_surface_snapshot_copy_on_write (cairo/src/cairo-surface-snapshot.c:189)
>==2==    by 0x4C82768: _cairo_surface_detach_snapshot (cairo/src/cairo-surface.c:348)
>==2==    by 0x4C824BB: _cairo_surface_detach_snapshots (cairo/src/cairo-surface.c:333)
>==2==    by 0x4C824BB: _cairo_surface_flush (cairo/src/cairo-surface.c:1545)
>==2==    by 0x4C82644: _cairo_surface_finish_snapshots (cairo/src/cairo-surface.c:1017)

and the test fails executing

(cd test && CAIRO_TEST_TARGET=svg12 valgrind --track-origins=yes .libs/cairo-test-suite -f record2x-paint)

the problem is that in _cairo_svg_surface_emit_recording_surface:

http://cgit.freedesktop.org/cairo/tree/src/cairo-svg-surface.c?id=8020e0bc8cbd3e5ac188eb305b74ae1c1f362a31#n1405

the cairo_recording_surface_t extents_pixels member is used even when the
recording surface is unbounded, in which case it is not uninitialized:

http://cgit.freedesktop.org/cairo/tree/src/cairo-recording-surface.c?id=8020e0bc8cbd3e5ac188eb305b74ae1c1f362a31#n399

using a arbitrarily big extent for unbounded recording surfaces prevents 
the failure and valgrind doesn't report that error.

Comment 1 Massimo 2015-01-17 16:52:12 UTC

Sorry that's not the relevant error, this is: 
 
 
>==2== Conditional jump or move depends on uninitialised value(s) 
>==2==    at 0x4C74335: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1725) 
>==2==    by 0x4C75A0B: _cairo_recording_surface_replay (cairo/src/cairo-recording-surface.c:2001) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_recording_surface (cairo/src/cairo-svg-surface.c:1423) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_composite_recording_pattern (cairo/src/cairo-svg-surface.c:1525) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_composite_pattern (cairo/src/cairo-svg-surface.c:1572) 
>==2==    by 0x4CF4E67: _cairo_svg_surface_emit_paint (cairo/src/cairo-svg-surface.c:2275) 
>==2==    by 0x4C83140: _cairo_surface_paint (cairo/src/cairo-surface.c:2117) 
>==2==    by 0x4C89A8D: _cairo_surface_wrapper_paint (cairo/src/cairo-surface-wrapper.c:165) 
>==2==    by 0x4C7480B: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1742) 
>==2==    by 0x4C75A78: _cairo_recording_surface_replay_region (cairo/src/cairo-recording-surface.c:2041) 
>==2==    by 0x4C56C13: _paint_page (cairo/src/cairo-paginated-surface.c:406) 
>==2==    by 0x4C56F4C: _cairo_paginated_surface_show_page (cairo/src/cairo-paginated-surface.c:509) 
>==2==    by 0x4C57057: _cairo_paginated_surface_finish (cairo/src/cairo-paginated-surface.c:204) 
>==2==    by 0x4C81C7D: _cairo_surface_finish (cairo/src/cairo-surface.c:1030) 
>==2==    by 0x4C828CE: cairo_surface_finish (cairo/src/cairo-surface.c:1077) 
>==2==    by 0x46BB87: _cairo_boilerplate_svg_finish_surface (cairo/boilerplate/cairo-boilerplate-svg.c:184) 
>==2==    by 0x4185B5: cairo_test_for_target (cairo/test/cairo-test.c:994) 
>==2==    by 0x4185B5: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532) 
>==2==    by 0x415955: _cairo_test_runner_draw (cairo/test/cairo-test-runner.c:255) 
>==2==    by 0x415955: main (cairo/test/cairo-test-runner.c:937) 
>==2==  Uninitialised value was created by a heap allocation 
>==2==    at 0x4A06BCF: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) 
>==2==    by 0x4C7544E: cairo_recording_surface_create (cairo/src/cairo-recording-surface.c:389) 
>==2==    by 0x447122: record_create (cairo/test/record2x.c:337) 
>==2==    by 0x447122: record_replay (cairo/test/record2x.c:365) 
>==2==    by 0x41857D: cairo_test_for_target (cairo/test/cairo-test.c:929) 
>==2==    by 0x41857D: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532)

Comment 2 Chris Wilson 2015-01-17 16:58:50 UTC

A lot of places use svg_surface->width/->height, but it looks doable to make an unbounded CAIRO_CONTENT_COLOR_ALPHA sVG surface.

Comment 3 GitLab Migration User 2018-08-25 13:34:39 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/cairo/cairo/issues/78.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.