New options to search for uninitialised core.

[Alex Cherepanov]

The debug option -Z@ doesn't provide a way to identify which
object is using the initialized memory. I made the attached patch
to search for the cause of the bug 689138. The bug was localized to
Zlib library, although Valgrind finds nothing wrong in Zlib.

This patch is posted to stimulate discussion about debug options
in Ghostscript. It is not intended for commit in the current form.

This patch introduces many new global variables. Does anybody see
any disadvantages?

The address space (printable ASCII) for the debug options is exhausted.
Single letter options are about to be exhausted too. Does anybody
object having long options?

Numbering invocations of gs_alloc_fill() was not particularly useful.
Does anybody like it ?

Index: gs/src/igcstr.c
===================================================================
--- gs/src/igcstr.c (revision 7792)
+++ gs/src/igcstr.c (working copy)
@@ -421,7 +421,7 @@
     }
  }
  gs_alloc_fill(cp->ctop, gs_alloc_fill_collected,
-      to - cp->ctop);
+      to - cp->ctop, 29);
  cp->ctop = to;
     }
 }
Index: gs/src/gsalloc.c
===================================================================
--- gs/src/gsalloc.c (revision 7792)
+++ gs/src/gsalloc.c (working copy)
@@ -498,7 +498,7 @@
  ptr[-1].o_type = pstype;\
  /* If debugging, clear the block in an attempt to */\
  /* track down uninitialized data errors. */\
- gs_alloc_fill(ptr, gs_alloc_fill_alloc, size);
+ gs_alloc_fill(ptr, gs_alloc_fill_alloc, size, 1);
 #define ELSEIF_BIG_FREELIST_ALLOC(ptr, imem, size, pstype)\
  }\
  else if (size > max_freelist_size &&\
@@ -506,7 +506,7 @@
  { ptr[-1].o_type = pstype;\
  /* If debugging, clear the block in an attempt to */\
  /* track down uninitialized data errors. */\
- gs_alloc_fill(ptr, gs_alloc_fill_alloc, size);
+ gs_alloc_fill(ptr, gs_alloc_fill_alloc, size, 2);
 #define ELSEIF_LIFO_ALLOC(ptr, imem, size, pstype)\
  }\
  else if ( (imem->cc.ctop - (byte *)(ptr = (obj_header_t *)imem->cc.cbot))\
@@ -520,7 +520,7 @@
  ptr++;\
  /* If debugging, clear the block in an attempt to */\
  /* track down uninitialized data errors. */\
- gs_alloc_fill(ptr, gs_alloc_fill_alloc, size);
+ gs_alloc_fill(ptr, gs_alloc_fill_alloc, size, 3);
 #define ELSE_ALLOC\
  }\
  else
@@ -778,7 +778,7 @@
     }
     if ((byte *) ptr + rounded_size == imem->cc.cbot) {
  alloc_trace(":-o ", imem, cname, pstype, size, ptr);
- gs_alloc_fill(ptr, gs_alloc_fill_free, size);
+ gs_alloc_fill(ptr, gs_alloc_fill_free, size, 4);
  imem->cc.cbot = (byte *) pp;
  /* IFF this object is adjacent to (or below) the byte after the
  * highest free object, do the consolidation within this chunk. */
@@ -838,7 +838,7 @@
     if ((byte *)pp >= imem->cc.int_freed_top)
  imem->cc.int_freed_top = (byte *)ptr + rounded_size;
     pp->o_type = &st_free; /* don't confuse GC */
-    gs_alloc_fill(ptr, gs_alloc_fill_free, size);
+    gs_alloc_fill(ptr, gs_alloc_fill_free, size, 5);
     *(obj_header_t **) ptr = *pfl;
     *pfl = (obj_header_t *) ptr;
     alloc_trace((size > max_freelist_size ? ":-oF" : ":-of"),
@@ -848,7 +848,7 @@
  /* Don't overwrite even if gs_alloc_debug is set. */
     } else {
  pp->o_type = &st_free; /* don't confuse GC */
- gs_alloc_fill(ptr, gs_alloc_fill_free, size);
+ gs_alloc_fill(ptr, gs_alloc_fill_free, size, 6);
     }
     alloc_trace(":-o#", imem, cname, pstype, size, ptr);
     imem->lost.objects += obj_size_round(size);
@@ -875,7 +875,7 @@
   alloc_trace_space(imem), client_name_string(cname), nbytes,
   (ulong) (imem->cc.ctop - nbytes));
  str = imem->cc.ctop -= nbytes;
- gs_alloc_fill(str, gs_alloc_fill_alloc, nbytes);
+ gs_alloc_fill(str, gs_alloc_fill_alloc, nbytes, 7);
  return str;
     }
     /* Try the next chunk. */
@@ -907,7 +907,7 @@
  imem->pcc = cp;
  imem->cc = *imem->pcc;
  gs_alloc_fill(imem->cc.cbase, gs_alloc_fill_free,
-      imem->cc.climit - imem->cc.cbase);
+      imem->cc.climit - imem->cc.cbase, 8);
  goto top;
     }
 }
@@ -927,7 +927,7 @@
     if_debug4('a', "[a%d|+>L]%s(%u) = 0x%lx\n",
       alloc_trace_space(imem), client_name_string(cname), nbytes,
       (ulong) str);
-    gs_alloc_fill(str, gs_alloc_fill_alloc, nbytes);
+    gs_alloc_fill(str, gs_alloc_fill_alloc, nbytes, 9);
     return str;
 }
 private byte *
@@ -954,9 +954,9 @@
 #ifdef DEBUG
  if (new_num > old_num)
     gs_alloc_fill(ptr + old_num, gs_alloc_fill_alloc,
-  new_num - old_num);
+  new_num - old_num, 10);
  else
-    gs_alloc_fill(data, gs_alloc_fill_free, old_num - new_num);
+    gs_alloc_fill(data, gs_alloc_fill_free, old_num - new_num, 11);
 #endif
     } else
  if (new_num < old_num) {
@@ -964,7 +964,7 @@
     ptr = data;
     imem->lost.strings += old_num - new_num;
     gs_alloc_fill(data + new_num, gs_alloc_fill_free,
-  old_num - new_num);
+  old_num - new_num, 12);
     if_debug5('A', "[a%d:<> ]%s(%u->%u) 0x%lx\n",
       alloc_trace_space(imem), client_name_string(cname),
       old_num, new_num, (ulong)ptr);
@@ -994,7 +994,7 @@
   (ulong) data);
  imem->lost.strings += nbytes;
     }
-    gs_alloc_fill(data, gs_alloc_fill_free, nbytes);
+    gs_alloc_fill(data, gs_alloc_fill_free, nbytes, 13);
 }
 
 private gs_memory_t *
@@ -1263,7 +1263,7 @@
  ptr->d.o.space_id = mem->space_id;
 #   endif
     ptr++;
-    gs_alloc_fill(ptr, gs_alloc_fill_alloc, lsize);
+    gs_alloc_fill(ptr, gs_alloc_fill_alloc, lsize, 14);
     return ptr;
 }
 
@@ -1630,7 +1630,7 @@
  mem->pcc = cp;
  mem->cc = *mem->pcc;
  gs_alloc_fill(mem->cc.cbase, gs_alloc_fill_free,
-      mem->cc.climit - mem->cc.cbase);
+      mem->cc.climit - mem->cc.cbase, 15);
     }
     return cp;
 }
@@ -1824,7 +1824,7 @@
  gs_free_object(parent, cdata, "alloc_free_chunk(data)");
     } else {
  cp->outer->inner_count--;
- gs_alloc_fill(cdata, gs_alloc_fill_free, csize);
+ gs_alloc_fill(cdata, gs_alloc_fill_free, csize, 16);
     }
     gs_free_object(parent, cp, "alloc_free_chunk(chunk struct)");
 }
Index: gs/src/igc.c
===================================================================
--- gs/src/igc.c (revision 7792)
+++ gs/src/igc.c (working copy)
@@ -359,7 +359,7 @@
  gs_free_object(state.heap, pms, "gc mark stack");
     else
  gs_alloc_fill(pms, gs_alloc_fill_free,
-      sizeof(*pms) + sizeof(ms_entry) * pms->count);
+      sizeof(*pms) + sizeof(ms_entry) * pms->count, 27);
     pms = prev;
  }
     }
@@ -1327,7 +1327,7 @@
     END_OBJECTS_SCAN
  if (cp->outer == 0 && chead->dest != cp->cbase)
  dpre = (obj_header_t *) cp->cbase; /* compacted this chunk into another */
-    gs_alloc_fill(dpre, gs_alloc_fill_collected, cp->cbot - (byte *) dpre);
+    gs_alloc_fill(dpre, gs_alloc_fill_collected, cp->cbot - (byte *) dpre, 28);
     cp->cbot = (byte *) dpre;
     cp->rcur = 0;
     cp->rtop = 0; /* just to be sure */
Index: gs/src/gxbcache.c
===================================================================
--- gs/src/gxbcache.c (revision 7792)
+++ gs/src/gxbcache.c (working copy)
@@ -94,7 +94,7 @@
  if_debug2('K', "[K]shortening bits 0x%lx by %u (initial)\n",
   (ulong) cbh, fsize - ssize);
     }
-    gs_alloc_fill(cbh, gs_alloc_fill_block, ssize);
+    gs_alloc_fill(cbh, gs_alloc_fill_block, ssize, 25);
     cbh->size = ssize;
     bc->bsize += ssize;
     bc->csize++;
@@ -136,7 +136,7 @@
     bc->csize--;
     bc->bsize -= size;
     bck->allocated -= size;
-    gs_alloc_fill(cbh, gs_alloc_fill_deleted, size);
+    gs_alloc_fill(cbh, gs_alloc_fill_deleted, size, 26);
     cbh->size = size; /* gs_alloc_fill may have overwritten */
     cb_head_set_free(cbh);
 }
Index: gs/src/gsmemory.c
===================================================================
--- gs/src/gsmemory.c (revision 7792)
+++ gs/src/gsmemory.c (working copy)
@@ -28,6 +28,11 @@
 const byte gs_alloc_fill_deleted = 0xd1;
 const byte gs_alloc_fill_free = 0xf1;
 
+/* Select which calls to gs_alloc_fill() have the effect */
+int gs_alloc_fill_mask = ~0;  /* all by default */
+uint gs_alloc_fill_from = 0, gs_alloc_fill_to = ~0;
+uint gs_alloc_fill_count = 0;
+
 /* A 'structure' type descriptor for free blocks. */
 gs_public_st_simple(st_free, byte, "(free)");
 
@@ -80,15 +85,21 @@
 /* Fill an unoccupied block with a pattern. */
 /* Note that the block size may be too large for a single memset. */
 void
-gs_alloc_memset(void *ptr, int /*byte */ fill, ulong lsize)
+gs_alloc_memset(void *ptr, int /*byte */ fill, ulong lsize, int id)
 {
-    ulong msize = lsize;
-    char *p = ptr;
-    int isize;
+    if (gs_alloc_fill_mask & (1u << id)) {
+        if ( gs_alloc_fill_count >= gs_alloc_fill_from &&
+     gs_alloc_fill_count <= gs_alloc_fill_to) {
+            ulong msize = lsize;
+            char *p = ptr;
+            int isize;
 
-    for (; msize; msize -= isize, p += isize) {
- isize = min(msize, max_int);
- memset(p, fill, isize);
+            for (; msize; msize -= isize, p += isize) {
+        isize = min(msize, max_int);
+        memset(p, fill, isize);
+            }
+        }
+ gs_alloc_fill_count ++;
     }
 }
 
Index: gs/src/gsmalloc.c
===================================================================
--- gs/src/gsmalloc.c (revision 7792)
+++ gs/src/gsmalloc.c (working copy)
@@ -192,7 +192,7 @@
     bp->cname = cname;
     mmem->allocated = bp;
     ptr = (byte *) (bp + 1);
-    gs_alloc_fill(ptr, gs_alloc_fill_alloc, size);
+    gs_alloc_fill(ptr, gs_alloc_fill_alloc, size, 17);
     mmem->used += size + sizeof(gs_malloc_block_t);
     if (mmem->used > mmem->max_used)
  mmem->max_used = mmem->used;
@@ -270,7 +270,7 @@
     mmem->used += new_size;
     if (new_size > old_size)
  gs_alloc_fill((byte *) new_ptr + old_size,
-      gs_alloc_fill_alloc, new_size - old_size);
+      gs_alloc_fill_alloc, new_size - old_size, 18);
     return new_ptr + 1;
 }
 private uint
@@ -314,7 +314,7 @@
  if (mmem->allocated)
     mmem->allocated->prev = 0;
  gs_alloc_fill(bp, gs_alloc_fill_free,
-      bp->size + sizeof(gs_malloc_block_t));
+      bp->size + sizeof(gs_malloc_block_t), 19);
  free(bp);
     } else {
  gs_malloc_block_t *np;
@@ -331,7 +331,7 @@
  np->next->prev = bp;
     mmem->used -= np->size + sizeof(gs_malloc_block_t);
     gs_alloc_fill(np, gs_alloc_fill_free,
-  np->size + sizeof(gs_malloc_block_t));
+  np->size + sizeof(gs_malloc_block_t), 20);
     free(np);
     return;
  }
@@ -413,7 +413,7 @@
     if_debug3('a', "[a]gs_heap_free_all(%s) 0x%lx(%u)\n",
       client_name_string(bp->cname), (ulong) (bp + 1),
       bp->size);
-    gs_alloc_fill(bp + 1, gs_alloc_fill_free, bp->size);
+    gs_alloc_fill(bp + 1, gs_alloc_fill_free, bp->size, 21);
     free(bp);
  }
     }
Index: gs/src/gsmdebug.h
===================================================================
--- gs/src/gsmdebug.h (revision 7792)
+++ gs/src/gsmdebug.h (working copy)
@@ -31,13 +31,13 @@
 #define gs_alloc_debug gs_debug['@']
 
 /* Conditionally fill unoccupied blocks with a pattern. */
-extern void gs_alloc_memset(void *, int /*byte */ , ulong);
+extern void gs_alloc_memset(void *, int /*byte */ , ulong, int id);
 
 #ifdef DEBUG
-#  define gs_alloc_fill(ptr, fill, len)\
-     BEGIN if ( gs_alloc_debug ) gs_alloc_memset(ptr, fill, (ulong)(len)); END
+#  define gs_alloc_fill(ptr, fill, len, id)\
+     BEGIN if ( gs_alloc_debug ) gs_alloc_memset(ptr, fill, (ulong)(len), id); END
 #else
-#  define gs_alloc_fill(ptr, fill, len)\
+#  define gs_alloc_fill(ptr, fill, len, id)\
      DO_NOTHING
 #endif
 
Index: gs/src/gsnogc.c
===================================================================
--- gs/src/gsnogc.c (revision 7792)
+++ gs/src/gsnogc.c (working copy)
@@ -72,7 +72,7 @@
  put_uu32(prev + NB, next);
     if_debug4('A', "[a%d:+>F]%s(%u) = 0x%lx\n", imem->space,
       client_name_string(cname), nbytes, (ulong) ptr);
-    gs_alloc_fill(ptr, gs_alloc_fill_alloc, nbytes);
+    gs_alloc_fill(ptr, gs_alloc_fill_alloc, nbytes, 22);
     imem->lost.strings -= nbytes;
     return ptr;
  }
@@ -92,7 +92,7 @@
  if_debug4('A', "[a%d:-> ]%s(%u) 0x%lx\n", imem->space,
   client_name_string(cname), size, (ulong) str);
  imem->cc.ctop += size;
- gs_alloc_fill(str, gs_alloc_fill_free, size);
+ gs_alloc_fill(str, gs_alloc_fill_free, size, 23);
  return;
     }
     if_debug4('A', "[a%d:->#]%s(%u) 0x%lx\n", imem->space,
@@ -156,7 +156,7 @@
  }
  put_uu32(str + NB, next);
  put_uu32(prev + NB, str_offset);
- gs_alloc_fill(str + 2 * NB, gs_alloc_fill_free, size - 2 * NB);
+ gs_alloc_fill(str + 2 * NB, gs_alloc_fill_free, size - 2 * NB, 24);
     } else {
  /*
  * Insert the string in the 1-byte free list(s).  Note that
Index: gs/src/imainarg.c
===================================================================
--- gs/src/imainarg.c (revision 7792)
+++ gs/src/imainarg.c (working copy)
@@ -103,6 +103,9 @@
 private void print_paths(gs_main_instance *);
 private void print_help_trailer(const gs_main_instance *);
 
+extern int gs_alloc_fill_mask;
+extern uint gs_alloc_fill_from, gs_alloc_fill_to;
+
 /* ------ Main program ------ */
 
 /* Process the command line with a given instance. */
@@ -272,7 +275,29 @@
     if (code < 0)
  return code;
     break;
- case '-': /* run with command line args */
+ case '-':
+            if (*arg) { /* long option */
+                if (!strncmp(arg, "alloc-fill-mask", 15)) {
+                    gs_debug['@'] = '\377';
+                    if (arg[15])
+                      gs_alloc_fill_mask = atoi(arg + 16);
+            return 0; /* show usage info on exit */
+                }
+ if (!strncmp(arg, "alloc-fill-from", 15)) {
+    gs_debug['@'] = '\377';
+    if (arg[15])
+        gs_alloc_fill_from = atoi(arg + 16);
+    return 0;
+ }
+ if (!strncmp(arg, "alloc-fill-to", 13)) {
+    gs_debug['@'] = '\377';
+    if (arg[13])
+        gs_alloc_fill_to = atoi(arg + 14);
+    return 0;
+ }
+                return 1;  
+            }
+            /* pass through. run with command line args */
  case '+':
     pal->expand_ats = false;
  case '@': /* ditto with @-expansion */
Index: gs/src/szlibc.c
===================================================================
--- gs/src/szlibc.c (revision 7792)
+++ gs/src/szlibc.c (working copy)
@@ -91,6 +91,7 @@
  gs_free_object(mem, block, "s_zlib_alloc(block)");
  return Z_NULL;
     }
+    memset(data, 0, size);
     block->data = data;
     block->next = zds->blocks;
     block->prev = 0;

_______________________________________________
gs-code-review mailing list
gs-code-review@...
http://www.ghostscript.com/mailman/listinfo/gs-code-review