Compiler not detecting obviously uninitialized variable

by

The obviousness with which this variable is not initialized is overstated. Path analysis costs time and your compiler vendors either didn’t want to implement the feature or thought it would cost you too much time — or you just didn’t explicitly opt-in.

For example, with clang:

$ clang -Wall -Wextra -c obvious.c 
$ clang -Wall -Wextra --analyze -c obvious.c 
obvious.c:9:11: warning: The right operand of '<' is a garbage value
    if (2 < totaldiff)  // at this point totaldiff is not initialized
          ^ ~~~~~~~~~
obvious.c:16:21: warning: The left operand of '==' is a garbage value
  return tauxtrouve == tauxprecis ;  // at this point tauxtrouve is potentially
         ~~~~~~~~~~ ^
2 warnings generated.

The difference in execution time for these naïve examples is negligible. But imagine a translation unit with thousands of lines, tens of functions, each with loops and heavy nesting. The number of paths quickly compounds and becomes a large burden to analyze whether or not the first iteration through the loop whether the assignment will occur prior to that comparison.

EDIT: @Matthieu points out that with LLVM/clang, the path analysis required to find use-of-uninitialized value does not compound as nesting increases because of the SSA notation used by the IR.

It wasn’t as simple as “-S -emit-llvm” like I’d hoped, but I found the SSA-notation output he described. I’ll be honest, I’m not familiar enough with LLVM IR to be sure, but I’ll take Matthieu’s word for it.

Bottom line: use clang with --analyze, or convince someone to fix the gcc bug.

; Function Attrs: nounwind uwtable
define i32 @NearEqual(i32 %tauxprecis, i32 %max, i32 %value) #0 {
  br label %1

; <label>:1                                       ; preds = %7, %0
  %tauxtrouve.0 = phi i32 [ undef, %0 ], [ %tauxtrouve.1, %7 ]
  %i.0 = phi i32 [ 0, %0 ], [ %8, %7 ]
  %2 = icmp slt i32 %i.0, %max
  br i1 %2, label %3, label %9

; <label>:3                                       ; preds = %1
  %4 = icmp slt i32 2, 2
  br i1 %4, label %5, label %6

; <label>:5                                       ; preds = %3
  br label %6

; <label>:6                                       ; preds = %5, %3
  %tauxtrouve.1 = phi i32 [ %value, %5 ], [ %tauxtrouve.0, %3 ]
  br label %7

; <label>:7                                       ; preds = %6
  %8 = add nsw i32 %i.0, 1
  br label %1

; <label>:9                                       ; preds = %1
  %10 = icmp eq i32 %tauxtrouve.0, %tauxprecis
  %11 = zext i1 %10 to i32
  ret i32 %11
}

More Related Contents:

  1. C error: Exited with non-zero status
  2. optimized sum of an array of doubles in C [duplicate]
  3. How to get all possible combination of 2xn matrix [closed]
  4. Fixing code to mitigate against buffer overflows and invalid inputs
  5. How to resolve a variable for char length? [closed]
  6. What REALLY happens when you don’t free after malloc before program termination?
  7. How to achieve function overloading in C?
  8. How to correctly use the extern keyword in C
  9. ‘float’ vs. ‘double’ precision
  10. Are parallel calls to send/recv on the same socket valid?
  11. Objective-C : BOOL vs bool
  12. What exactly is a C pointer if not a memory address?
  13. How Recursion works in C
  14. How to use netlink socket to communicate with a kernel module?
  15. Does either ANSI C or ISO C specify what -5 % 10 should be?
  16. Enumerate factors of a number directly in ascending order without sorting?
  17. How to use nan and inf in C?
  18. Using intptr_t instead of void*?
  19. How to find the physical address of a variable from user-space in Linux?
  20. How to create static linked shared libraries
  21. Passing parameters dynamically to variadic functions
  22. Why does GCC not warn for unreachable code?
  23. Segmentation Fault While Creating Large Arrays in C
  24. void main() { if(sizeof(int) > -1) printf(“true”); else printf(“false”); ; [duplicate]
  25. What’s the meaning of this piece of code? void (*signal(int sig, void (*func)(int)))(int);
  26. What is time(NULL) in C?
  27. Is it possible to call a non-exported function that resides in an exe?
  28. memory allocation in Stack and Heap
  29. what is the difference between difftime and ‘-‘?
  30. Is it Undefined Behaviour to cast away the constness of a function parameter?

Leave a Comment