Bug 88538 - Conditional jump depends on uninitialised value testing record2x-paint.svg12.argb32
Summary: Conditional jump depends on uninitialised value testing record2x-paint.svg12....
Status: RESOLVED MOVED
Alias: None
Product: cairo
Classification: Unclassified
Component: svg backend (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Emmanuel Pacaud
QA Contact: cairo-bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-17 16:47 UTC by Massimo
Modified: 2018-08-25 13:34 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Massimo 2015-01-17 16:47:34 UTC
valgrind reports

>==2== Conditional jump or move depends on uninitialised value(s)
>==2==    at 0x4C740B9: _cairo_recording_surface_merge_source_attributes.isra.8 (cairo/src/cairo-recording-surface.c:1628)
>==2==    by 0x4C7484B: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1865)
>==2==    by 0x4C75A4E: _cairo_recording_surface_replay_and_create_regions (cairo/src/cairo-recording-surface.c:2029)
>==2==    by 0x4C56B2D: _paint_page (cairo/src/cairo-paginated-surface.c:356)
>==2==    by 0x4C56F4C: _cairo_paginated_surface_show_page (cairo/src/cairo-paginated-surface.c:509)
>==2==    by 0x4C57057: _cairo_paginated_surface_finish (cairo/src/cairo-paginated-surface.c:204)
>==2==    by 0x4C81C7D: _cairo_surface_finish (cairo/src/cairo-surface.c:1030)
>==2==    by 0x4C828CE: cairo_surface_finish (cairo/src/cairo-surface.c:1077)
>==2==    by 0x46BB87: _cairo_boilerplate_svg_finish_surface (cairo/boilerplate/cairo-boilerplate-svg.c:184)
>==2==    by 0x4185B5: cairo_test_for_target (cairo/test/cairo-test.c:994)
>==2==    by 0x4185B5: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532)
>==2==    by 0x415955: _cairo_test_runner_draw (cairo/test/cairo-test-runner.c:255)
>==2==    by 0x415955: main (cairo/test/cairo-test-runner.c:937)
>==2==  Uninitialised value was created by a heap allocation
>==2==    at 0x4A06BCF: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
>==2==    by 0x4C73760: _cairo_recording_surface_snapshot (cairo/src/cairo-recording-surface.c:1427)
>==2==    by 0x4C885B3: _cairo_surface_snapshot_copy_on_write (cairo/src/cairo-surface-snapshot.c:189)
>==2==    by 0x4C82768: _cairo_surface_detach_snapshot (cairo/src/cairo-surface.c:348)
>==2==    by 0x4C824BB: _cairo_surface_detach_snapshots (cairo/src/cairo-surface.c:333)
>==2==    by 0x4C824BB: _cairo_surface_flush (cairo/src/cairo-surface.c:1545)
>==2==    by 0x4C82644: _cairo_surface_finish_snapshots (cairo/src/cairo-surface.c:1017)

and the test fails executing

(cd test && CAIRO_TEST_TARGET=svg12 valgrind --track-origins=yes .libs/cairo-test-suite -f record2x-paint)

the problem is that in _cairo_svg_surface_emit_recording_surface:

http://cgit.freedesktop.org/cairo/tree/src/cairo-svg-surface.c?id=8020e0bc8cbd3e5ac188eb305b74ae1c1f362a31#n1405

the cairo_recording_surface_t extents_pixels member is used even when the
recording surface is unbounded, in which case it is not uninitialized:

http://cgit.freedesktop.org/cairo/tree/src/cairo-recording-surface.c?id=8020e0bc8cbd3e5ac188eb305b74ae1c1f362a31#n399

using a arbitrarily big extent for unbounded recording surfaces prevents 
the failure and valgrind doesn't report that error.
Comment 1 Massimo 2015-01-17 16:52:12 UTC
Sorry that's not the relevant error, this is: 
 
 
>==2== Conditional jump or move depends on uninitialised value(s) 
>==2==    at 0x4C74335: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1725) 
>==2==    by 0x4C75A0B: _cairo_recording_surface_replay (cairo/src/cairo-recording-surface.c:2001) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_recording_surface (cairo/src/cairo-svg-surface.c:1423) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_composite_recording_pattern (cairo/src/cairo-svg-surface.c:1525) 
>==2==    by 0x4CF3B2E: _cairo_svg_surface_emit_composite_pattern (cairo/src/cairo-svg-surface.c:1572) 
>==2==    by 0x4CF4E67: _cairo_svg_surface_emit_paint (cairo/src/cairo-svg-surface.c:2275) 
>==2==    by 0x4C83140: _cairo_surface_paint (cairo/src/cairo-surface.c:2117) 
>==2==    by 0x4C89A8D: _cairo_surface_wrapper_paint (cairo/src/cairo-surface-wrapper.c:165) 
>==2==    by 0x4C7480B: _cairo_recording_surface_replay_internal (cairo/src/cairo-recording-surface.c:1742) 
>==2==    by 0x4C75A78: _cairo_recording_surface_replay_region (cairo/src/cairo-recording-surface.c:2041) 
>==2==    by 0x4C56C13: _paint_page (cairo/src/cairo-paginated-surface.c:406) 
>==2==    by 0x4C56F4C: _cairo_paginated_surface_show_page (cairo/src/cairo-paginated-surface.c:509) 
>==2==    by 0x4C57057: _cairo_paginated_surface_finish (cairo/src/cairo-paginated-surface.c:204) 
>==2==    by 0x4C81C7D: _cairo_surface_finish (cairo/src/cairo-surface.c:1030) 
>==2==    by 0x4C828CE: cairo_surface_finish (cairo/src/cairo-surface.c:1077) 
>==2==    by 0x46BB87: _cairo_boilerplate_svg_finish_surface (cairo/boilerplate/cairo-boilerplate-svg.c:184) 
>==2==    by 0x4185B5: cairo_test_for_target (cairo/test/cairo-test.c:994) 
>==2==    by 0x4185B5: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532) 
>==2==    by 0x415955: _cairo_test_runner_draw (cairo/test/cairo-test-runner.c:255) 
>==2==    by 0x415955: main (cairo/test/cairo-test-runner.c:937) 
>==2==  Uninitialised value was created by a heap allocation 
>==2==    at 0x4A06BCF: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) 
>==2==    by 0x4C7544E: cairo_recording_surface_create (cairo/src/cairo-recording-surface.c:389) 
>==2==    by 0x447122: record_create (cairo/test/record2x.c:337) 
>==2==    by 0x447122: record_replay (cairo/test/record2x.c:365) 
>==2==    by 0x41857D: cairo_test_for_target (cairo/test/cairo-test.c:929) 
>==2==    by 0x41857D: _cairo_test_context_run_for_target (cairo/test/cairo-test.c:1532)
Comment 2 Chris Wilson 2015-01-17 16:58:50 UTC
A lot of places use svg_surface->width/->height, but it looks doable to make an unbounded CAIRO_CONTENT_COLOR_ALPHA sVG surface.
Comment 3 GitLab Migration User 2018-08-25 13:34:39 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/cairo/cairo/issues/78.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.