[Bug c/105013] New: Valgrind reports accessing uninitialized memory when -O2 option is used

[Bug c/105013] New: Valgrind reports accessing uninitialized memory when -O2 option is used

[jamesallwright at yahoo dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

            Bug ID: 105013
           Summary: Valgrind reports accessing uninitialized memory when
                    -O2 option is used
           Product: gcc
           Version: 9.4.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jamesallwright at yahoo dot co.uk
  Target Milestone: ---

Created attachment 52660
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52660&action=edit
bug.i generated by gcc

When the below code is compiled using the -O2 option, valgrind reports 
"Conditional jump or move depends on uninitialised value(s)".
This does not happen if -O2 is not used.
#include <stdio.h>
#include <string.h>
#include <ctype.h>

void
readstr (char out[], char **in, int limit)
{
  int i;

  i = 0;
  while ((isalpha (**in)) && (i < limit - 1))
    {
      out[i] = **in;
      i = i + 1;
      *in = *in + 1;
    };
  out[i] = '\0';
  printf("out = %s\n", out);
  if (strcmp(out, "channel") == 0) {
    printf("channel\n");
  }
}

void example_func(char *s)
    {
    char command[40];
    char *p;

    p = s;
    readstr(command, &p, 40);

    printf("command = %s\n", command);
    /* line below generates valgrind warning
     * Conditional jump or move depends on uninitialised value(s)
     */
    if (strcmp(command, "channel") == 0) {
      printf("channel\n");
    }
}

int main(int argc, char **argv)
{ 
  example_func("%%sausage 1 2");
}

As requested in your bug submission notes, I ran gcc with data collextion
options:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/9/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:hsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu
9.4.0-1ubuntu1~20.04' --with-bugurl=file:///usr/share/doc/gcc-9/README.Bugs
--enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,gm2 --prefix=/usr
--with-gcc-major-version-only --program-suffix=-9
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new
--enable-gnu-unique-object --disable-vtable-verify --enable-plugin
--enable-default-pie --with-system-zlib --with-target-system-zlib=auto
--enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib
--with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-9-yTrUTS/gcc-9-9.4.0/debian/tmp-nvptx/usr,hsa
--without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04) 

I am also attaching bug.i generated by this command

[Bug c/105013] Valgrind reports accessing uninitialized memory when -O2 option is used

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |WAITING
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2022-03-22

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Can you please show the valgrind error?

[Bug c/105013] Valgrind reports accessing uninitialized memory when -O2 option is used

[jamesallwright at yahoo dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

--- Comment #2 from James Allwright <jamesallwright at yahoo dot co.uk> ---
Here is the valgrind output

valgrind ./bug
==2490== Memcheck, a memory error detector
==2490== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2490== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==2490== Command: ./bug
==2490== 
out = 
command = 
==2490== Conditional jump or move depends on uninitialised value(s)
==2490==    at 0x1092DB: example_func (bug.c:37)
==2490==    by 0x1090D3: main (bug.c:44)
==2490== 
==2490== 
==2490== HEAP SUMMARY:
==2490==     in use at exit: 0 bytes in 0 blocks
==2490==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==2490== 
==2490== All heap blocks were freed -- no leaks are possible
==2490== 
==2490== Use --track-origins=yes to see where uninitialised values come from
==2490== For lists of detected and suppressed errors, rerun with: -s
==2490== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

[Bug c/105013] Valgrind reports accessing uninitialized memory when -O2 option is used

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
I can't reproduce it with valgrind 3.17 where I tried various GCC versions.
Can you please test using valgrind with --expensive-definedness-checks=yes?

Please attach assembly file that causes that (-S) option.

[Bug c/105013] Valgrind reports accessing uninitialized memory when -O2 option is used

[jamesallwright at yahoo dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

--- Comment #4 from James Allwright <jamesallwright at yahoo dot co.uk> ---
I have re-run with the suggested options --track-origins=yes and -s :

 $ valgrind --track-origins=yes -s ./bug
==16956== Memcheck, a memory error detector
==16956== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==16956== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==16956== Command: ./bug
==16956== 
out = 
command = 
==16956== Conditional jump or move depends on uninitialised value(s)
==16956==    at 0x1092DB: example_func (bug.c:37)
==16956==    by 0x1090D3: main (bug.c:44)
==16956==  Uninitialised value was created by a stack allocation
==16956==    at 0x109280: example_func (bug.c:26)
==16956== 
==16956== 
==16956== HEAP SUMMARY:
==16956==     in use at exit: 0 bytes in 0 blocks
==16956==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==16956== 
==16956== All heap blocks were freed -- no leaks are possible
==16956== 
==16956== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==16956== 
==16956== 1 errors in context 1 of 1:
==16956== Conditional jump or move depends on uninitialised value(s)
==16956==    at 0x1092DB: example_func (bug.c:37)
==16956==    by 0x1090D3: main (bug.c:44)
==16956==  Uninitialised value was created by a stack allocation
==16956==    at 0x109280: example_func (bug.c:26)
==16956== 
==16956== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

When I run with --expensive-definedness-checks=yes, no problems are
reported:

$ valgrind --expensive-definedness-checks=yes ./bug
==16924== Memcheck, a memory error detector
==16924== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==16924== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==16924== Command: ./bug
==16924== 
out = 
command = 
==16924== 
==16924== HEAP SUMMARY:
==16924==     in use at exit: 0 bytes in 0 blocks
==16924==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==16924== 
==16924== All heap blocks were freed -- no leaks are possible
==16924== 
==16924== For lists of detected and suppressed errors, rerun with: -s
==16924== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[Bug c/105013] Valgrind reports accessing uninitialized memory when -O2 option is used

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105013

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |INVALID

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Good, then let's close it as invalid.