1536537 - Conditional jump or move depends on uninitialized values in [@ mozilla::FramePointerStackWalk]

Status: NEW

(Core :: Gecko Profiler, defect, P3)

Description

[Tyson Smith [:tsmith]]

Came across this while running with Valgrind. I'm not sure how actionable this is.

Stack is from m-c:
BuildID=20190318220034
SourceStamp=2abb636ad481768b7c88619080cf224b2c266b2d

==114108== Thread 17 BHMgr Monitor:
==114108== Conditional jump or move depends on uninitialised value(s)
==114108==    at 0x112B76: mozilla::FramePointerStackWalk(void (*)(unsigned int, void*, void*, void*), unsigned int, unsigned int, void*, void**, void*) (StackWalk.cpp:858)
==114108==    by 0x130DA2FC: profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool) (platform.cpp:1317)
==114108==    by 0x131B31AC: mozilla::BackgroundHangManager::RunMonitorThread() (ThreadStackHelper.cpp:137)
==114108==    by 0x131B2E2C: mozilla::BackgroundHangManager::MonitorThread(void*) (BackgroundHangMonitor.cpp:79)
==114108==    by 0x407B0F8: _pt_root (ptthread.c:201)
==114108==    by 0x4E446DA: start_thread (pthread_create.c:463)
==114108==    by 0x5EC888E: clone (clone.S:95)
==114108==  Uninitialised value was created by a stack allocation
==114108==    at 0x5DD9543: __dcigettext (dcigettext.c:661)

Comment 1

[Eric Rahm [:erahm]]

Tyson, do you know which variable it's upset about?

Comment 2

[Tyson Smith [:tsmith]]

I'm not sure, can you get that information from Valgrind? If so I'd enable that.

Comment 3

[Eric Rahm [:erahm]]

(In reply to Tyson Smith [:tsmith] from comment #2)

I'm not sure, can you get that information from Valgrind? If so I'd enable that.

Lets redirect to one of our Valgrind experts. Nick, I'm not sure if you're familiar with this part of Valgrind, but do you know if we can get more actionable info here?

Comment 4

[Nicholas Nethercote [inactive]]

The "Uninitialised value was created by a stack allocation" message shows that Valgrind was run with --track-origins=yes, which already means it's doing extra work (beyond the default) to give more info about the source of the undefinedness.

https://github.com/lattera/glibc/blob/895ef79e04a953cac1493863bcae29ad85657ee1/intl/dcigettext.c#L661 suggests (assuming that code matches the code on the machine in question) that something in the alloca'd memory is being used without being initialized. I don't know why stack-walking would hit that, seems a bit weird.

Comment 5

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

ASAN also tripped in that function, so I MOZ_ASAN_BLACKLISTed it in https://bugzilla.mozilla.org/show_bug.cgi?id=1528842
Could this be related?
(And is there a real issue, which I should have not hidden under the ASAN carpet?)

Comment 6

[Tyson Smith [:tsmith]]

In an attempt to avoid false positives I re-ran using:
Valgrind master commit 965876e22b863bca1cbe7db9578e648397a705a7
m-c commit 92d1c344e7c5 (built with GCC 7.3.0 and -g -O0)

I here is the result:

==4922== Thread 11 BHMgr Monitor:
==4922== Conditional jump or move depends on uninitialised value(s)
==4922==    at 0x116EA1: mozilla::FramePointerStackWalk(void (*)(unsigned int, void*, void*, void*), unsigned int, unsigned int, void*, void**, void*) (StackWalk.cpp:858)
==4922==    by 0x16D850F2: DoFramePointerBacktrace(mozilla::BaseAutoLock<PSMutex&> const&, RegisteredThread const&, Registers const&, NativeStack&) (platform.cpp:1317)
==4922==    by 0x16D8E74D: profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool)::{lambda(Registers const&)#1}::operator()(Registers const&) const (platform.cpp:4044)
==4922==    by 0x16D94737: void Sampler::SuspendAndSampleAndResumeThread<profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool)::{lambda(Registers const&)#1}>(mozilla::BaseAutoLock<PSMutex&> const&, RegisteredThread const&, profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool)::{lambda(Registers const&)#1} const&) (platform-linux-android.cpp:329)
==4922==    by 0x16D8EA11: profiler_suspend_and_sample_thread(int, unsigned int, ProfilerStackCollector&, bool) (platform.cpp:4033)
==4922==    by 0x16EFBB4A: mozilla::ThreadStackHelper::GetStack(mozilla::HangStack&, nsTSubstring<char>&, bool) (ThreadStackHelper.cpp:137)
==4922==    by 0x16EF8604: mozilla::BackgroundHangManager::RunMonitorThread() (BackgroundHangMonitor.cpp:375)
==4922==    by 0x16EFD37F: mozilla::BackgroundHangManager::MonitorThread(void*) (BackgroundHangMonitor.cpp:79)
==4922==    by 0x407D803: _pt_root (ptthread.c:201)
==4922==    by 0x4E446DA: start_thread (pthread_create.c:463)
==4922==    by 0x5CC088E: clone (clone.S:95)
==4922==  Uninitialised value was created by a stack allocation
==4922==    at 0x1184556E: base::MessagePumpLibevent::ScheduleWork() (message_pump_libevent.cc:365)
==4922==