Control: tags 918696 + upstream patch
Hello Bill Allombert, dear Maintainer,
I tried to have a look at this crash and could
reproduce it inside a Buster amd64 qemu VM.
See below a backtrace of the crash with debug symbols installed.
Running with valgrind revealed accesses to uninitialized memory.
When this memory gets initialized to zero the crash does not
happen any longer.
Some more information in attached file and one more unrelated
valgrind output showing an invalid read below TkpOpenDisplay.
Find the added initializations in the patch attached.
Kind regards,
Bernhard
(gdb) bt
#0 0x000055be75810e10 in Engine::UpdatePV (sm=0x7ffe87a2a1a0,
this=0x55be77c71170) at src/engine.h:297
#1 Engine::Search (this=this@entry=0x55be77c71170, depth=depth@entry=1,
alpha=680, alpha@entry=860, beta=beta@entry=861,
tryNullMove=tryNullMove@entry=true) at src/engine.cpp:1628
#2 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=1, alpha=alpha@entry=-861, beta=beta@entry=-860,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#3 0x000055be75810aa8 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=2, alpha=alpha@entry=860, beta=beta@entry=861,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1772
#4 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=2, alpha=alpha@entry=-861, beta=beta@entry=-860,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#5 0x000055be75810aa8 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=3, alpha=860, alpha@entry=31997, beta=beta@entry=31998,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1772
#6 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=3, alpha=alpha@entry=-31998, beta=beta@entry=-31997,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#7 0x000055be75812138 in Engine::SearchRoot (this=this@entry=0x55be77c71170,
depth=depth@entry=4, alpha=31997, alpha@entry=31962, beta=beta@entry=32032,
mlist=mlist@entry=0x7ffe87a32710) at src/engine.cpp:1531
#8 0x000055be75812ec3 in Engine::Think (this=<optimized out>,
mlist=0x7ffe87a32710) at src/engine.cpp:1449
#9 0x000055be757dd38a in sc_pos_bestSquare (ti=0x55be760ba000, argv=<optimized
out>, argc=<optimized out>, cd=<optimized out>) at src/tkscid.cpp:6056
#10 0x000055be757e4f49 in sc_pos_bestSquare (argv=0x55be77aa2420, argc=3,
ti=0x55be760ba000, cd=0x0) at /usr/include/c++/6/bits/stl_algo.h:1887
#11 sc_pos (cd=0x0, ti=0x55be760ba000, argc=3, argv=0x55be77aa2420) at
src/tkscid.cpp:5725
#12 0x00007f1833d161bb in TclInvokeStringCommand (clientData=0x55be760f9fe0,
interp=0x55be760ba000, objc=3, objv=0x55be77aa2400) at ./generic/tclBasic.c:2479
#13 0x00007f1833d17f87 in TclNRRunCallbacks
(interp=interp@entry=0x55be760ba000, result=0, rootPtr=0x0) at
./generic/tclBasic.c:4461
#14 0x00007f1833d1798f in Tcl_EvalObjv (interp=interp@entry=0x55be760ba000,
objc=objc@entry=2, objv=objv@entry=0x55be77aa2160, flags=flags@entry=2097168)
at ./generic/tclBasic.c:4189
#15 0x00007f1833d1937f in TclEvalEx (interp=0x55be760ba000,
script=0x7ffe87a36f30 "enterSquare 52", numBytes=<optimized out>,
flags=<optimized out>, line=line@entry=1, clNextOuter=clNextOuter@entry=0x0,
outerScript=0x7ffe87a36f30 "enterSquare 52") at ./generic/tclBasic.c:5330
#16 0x00007f1833d18ce3 in Tcl_EvalEx (interp=<optimized out>, script=<optimized
out>, numBytes=<optimized out>, flags=<optimized out>) at
./generic/tclBasic.c:4995
#17 0x00007f1832cf57bd in Tk_BindEvent (bindPtr=<optimized out>,
eventPtr=eventPtr@entry=0x7ffe87a370c0, tkwin=0x55be77914e30,
numObjects=<optimized out>, objectPtr=<optimized out>,
objectPtr@entry=0x55be77c613a0) at ./unix/../generic/tkBind.c:1518
#18 0x00007f1832d47fd8 in CanvasDoEvent
(canvasPtr=canvasPtr@entry=0x55be76593340,
eventPtr=eventPtr@entry=0x7ffe87a370c0) at ./unix/../generic/tkCanvas.c:5228
#19 0x00007f1832d479f9 in PickCurrentItem
(canvasPtr=canvasPtr@entry=0x55be76593340,
eventPtr=eventPtr@entry=0x55be77952130) at ./unix/../generic/tkCanvas.c:5046
#20 0x00007f1832d47674 in CanvasBindProc (clientData=0x55be76593340,
eventPtr=0x55be77952130) at ./unix/../generic/tkCanvas.c:4824
#21 0x00007f1832d04b1f in Tk_HandleEvent
(eventPtr=eventPtr@entry=0x55be77952130) at ./unix/../generic/tkEvent.c:1352
#22 0x00007f1832d05360 in WindowEventProc (flags=<optimized out>,
evPtr=0x55be77952130) at ./unix/../generic/tkEvent.c:1764
#23 WindowEventProc (evPtr=evPtr@entry=0x55be77952120, flags=flags@entry=-3) at
./unix/../generic/tkEvent.c:1735
#24 0x00007f1833ddff2f in Tcl_ServiceEvent (flags=flags@entry=-3) at
./generic/tclNotify.c:670
#25 0x00007f1833de0195 in Tcl_DoOneEvent (flags=-3) at ./generic/tclNotify.c:903
#26 0x00007f1832d057c2 in Tk_MainLoop () at ./unix/../generic/tkEvent.c:2148
#27 0x00007f1833dda151 in Tcl_MainEx (argc=<optimized out>, argv=<optimized
out>, appInitProc=0x55be757e7de0 <UI_impl::initTclTk(Tcl_Interp*)>,
interp=0x55be760ba000) at ./generic/tclMain.c:607
#28 0x000055be757e97fd in UI_impl::Main (argc=2, argv=0x7ffe87a37a18,
exit=<optimized out>) at src/ui_tcltk.h:60
#29 0x00007f18335f509b in __libc_start_main (main=0x55be75771490 <main(int,
char**)>, argc=2, argv=0x7ffe87a37a18, init=<optimized out>, fini=<optimized
out>, rtld_fini=<optimized out>, stack_end=0x7ffe87a37a08) at
../csu/libc-start.c:308
#30 0x000055be75775369 in _start ()
From d1c2edae061775f2e4e410ff9ee62cdeb2c1536f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?= <[email protected]>
Date: Tue, 8 Jan 2019 18:09:02 +0100
Subject: [PATCH] Avoid crash because of unintialized memory access.
Debian-Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918696
---
src/engine.cpp | 2 ++
src/engine.h | 1 +
2 files changed, 3 insertions(+)
diff --git a/src/engine.cpp b/src/engine.cpp
index be8c1c7..8cdeb5c 100644
--- a/src/engine.cpp
+++ b/src/engine.cpp
@@ -1091,6 +1091,7 @@ Engine::SetHashTableKilobytes (uint size)
if (TranTable != NULL) { delete[] TranTable; }
TranTable = new transTableEntryT [TranTableSize];
#endif
+ memset(TranTable, 0, sizeof(*TranTable)*TranTableSize);
}
ClearHashTable();
}
@@ -1113,6 +1114,7 @@ Engine::SetPawnTableKilobytes (uint size)
if (PawnTable != NULL) { delete[] PawnTable; }
PawnTable = new pawnTableEntryT [PawnTableSize];
#endif
+ memset(PawnTable, 0, sizeof(*PawnTable)*PawnTableSize);
}
ClearPawnTable();
}
diff --git a/src/engine.h b/src/engine.h
index c6b437d..2877331 100644
--- a/src/engine.h
+++ b/src/engine.h
@@ -315,6 +315,7 @@ Engine::UpdatePV (simpleMoveT * sm)
inline void
Engine::ClearKillerMoves (void)
{
+ memset(KillerMove, 0, sizeof(KillerMove));
for (uint i=0; i < ENGINE_MAX_PLY; i++) {
KillerMove[i][0].from = NULL_SQUARE;
KillerMove[i][1].from = NULL_SQUARE;
--
2.20.1
# Buster amd64 qemu VM
apt update
apt dist-upgrade
apt install systemd-coredump xserver-xorg lightdm openbox tmux gdb valgrind
scid scid-dbgsym libtcl8.6-dbgsym libtk8.6-dbgsym libx11-6-dbgsym
apt install devscripts dpkg-dev
apt build-dep scid
mkdir source/scid/orig -p
cd source/scid/orig
apt source scid
cd
mkdir source/libx11-6/orig -p
cd source/libx11-6/orig
apt source libx11-6
mkdir libx11-1.6.7/1/2/3/4 -p
cd
systemctl start lightdm
export DISPLAY=:0
scid
# Copy text to clipboard: 8/k1K1N3/8/8/8/3B4/8/8 w - - 2 2
Edit - Paste Start Board
$ scid
Speicherzugriffsfehler (Speicherabzug geschrieben)
dmesg:
[ 315.207856] tkscid[13252]: segfault at 55be77c8d000 ip 000055be75810e10 sp
00007ffe87a2a140 error 4 in tkscid[55be75766000+e5000]
[ 315.207867] Code: 0c 07 41 8b 81 6c 68 00 00 39 c2 73 48 4d 69 da 84 02 00
00 66 0f 1f 44 00 00 89 d0 83 c2 01 48 c1 e0 04 4a 8d 0c 18 4c 01 c0 <49> 8b b4
07 70 68 00 00 49 8b bc 07 78 68 00 00 49 89 b4 0f 70 68
root@debian:~# coredumpctl list
TIME PID UID GID SIG COREFILE EXE
Tue 2019-01-08 15:54:20 CET 13252 1000 1000 11 present /usr/games/tkscid
root@debian:~# coredumpctl gdb 13252
PID: 13252 (tkscid)
UID: 1000 (benutzer)
GID: 1000 (benutzer)
Signal: 11 (SEGV)
Timestamp: Tue 2019-01-08 15:54:20 CET (2min 15s ago)
Command Line: /usr/games/tkscid /usr/games/scid
Executable: /usr/games/tkscid
Control Group: /user.slice/user-1000.slice/session-3.scope
Unit: session-3.scope
Slice: user-1000.slice
Session: 3
Owner UID: 1000 (benutzer)
Boot ID: 08e0a90b65454158bd833e68c550e10b
Machine ID: 32f43b50ac8c4b21941bc0b02f8e7811
Hostname: debian
Storage:
/var/lib/systemd/coredump/core.tkscid.1000.08e0a90b65454158bd833e68c550e10b.13252.1546959260000000.lz4
Message: Process 13252 (tkscid) of user 1000 dumped core.
Stack trace of thread 13252:
#0 0x000055be75810e10 n/a (tkscid)
#1 0x000055be75810798 n/a (tkscid)
#2 0x000055be75810aa8 n/a (tkscid)
#3 0x000055be75810798 n/a (tkscid)
#4 0x000055be75810aa8 n/a (tkscid)
#5 0x000055be75810798 n/a (tkscid)
#6 0x000055be75812138 n/a (tkscid)
#7 0x000055be75812ec3 n/a (tkscid)
#8 0x000055be757dd38a n/a (tkscid)
#9 0x000055be757e4f49 n/a (tkscid)
#10 0x00007f1833d161bb TclInvokeStringCommand (libtcl8.6.so)
#11 0x00007f1833d17f87 TclNRRunCallbacks (libtcl8.6.so)
#12 0x00007f1833d1937f n/a (libtcl8.6.so)
#13 0x00007f1833d18ce3 Tcl_EvalEx (libtcl8.6.so)
#14 0x00007f1832cf57bd Tk_BindEvent (libtk8.6.so)
#15 0x00007f1832d47fd8 n/a (libtk8.6.so)
#16 0x00007f1832d479f9 n/a (libtk8.6.so)
#17 0x00007f1832d47674 n/a (libtk8.6.so)
#18 0x00007f1832d04b1f Tk_HandleEvent (libtk8.6.so)
#19 0x00007f1832d05360 n/a (libtk8.6.so)
#20 0x00007f1833ddff2f Tcl_ServiceEvent (libtcl8.6.so)
#21 0x00007f1833de0195 Tcl_DoOneEvent (libtcl8.6.so)
#22 0x00007f1832d057c2 Tk_MainLoop (libtk8.6.so)
#23 0x00007f1833dda151 Tcl_MainEx (libtcl8.6.so)
#24 0x000055be757e97fd n/a (tkscid)
#25 0x00007f18335f509b __libc_start_main (libc.so.6)
#26 0x000055be75775369 n/a (tkscid)
Stack trace of thread 13258:
#0 0x00007f18336c23f7 __select (libc.so.6)
#1 0x00007f1833e23b8a n/a (libtcl8.6.so)
#2 0x00007f1833799fa3 start_thread (libpthread.so.0)
#3 0x00007f18336ca88f __clone (libc.so.6)
...
Core was generated by `/usr/games/tkscid /usr/games/scid'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000055be75810e10 in ?? ()
[Current thread is 1 (Thread 0x7f18335aed00 (LWP 13252))]
(gdb) set width 0
(gdb) set pagination off
(gdb) bt
#0 0x000055be75810e10 in ?? ()
#1 0x000055be75810798 in ?? ()
#2 0x000055be75810aa8 in ?? ()
#3 0x000055be75810798 in ?? ()
#4 0x000055be75810aa8 in ?? ()
#5 0x000055be75810798 in ?? ()
#6 0x000055be75812138 in ?? ()
#7 0x000055be75812ec3 in ?? ()
#8 0x000055be757dd38a in ?? ()
#9 0x000055be757e4f49 in ?? ()
#10 0x00007f1833d161bb in TclInvokeStringCommand () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#11 0x00007f1833d17f87 in TclNRRunCallbacks () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#12 0x00007f1833d1937f in ?? () from /usr/lib/x86_64-linux-gnu/libtcl8.6.so
#13 0x00007f1833d18ce3 in Tcl_EvalEx () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#14 0x00007f1832cf57bd in Tk_BindEvent () from
/usr/lib/x86_64-linux-gnu/libtk8.6.so
#15 0x00007f1832d47fd8 in ?? () from /usr/lib/x86_64-linux-gnu/libtk8.6.so
#16 0x00007f1832d479f9 in ?? () from /usr/lib/x86_64-linux-gnu/libtk8.6.so
#17 0x00007f1832d47674 in ?? () from /usr/lib/x86_64-linux-gnu/libtk8.6.so
#18 0x00007f1832d04b1f in Tk_HandleEvent () from
/usr/lib/x86_64-linux-gnu/libtk8.6.so
#19 0x00007f1832d05360 in ?? () from /usr/lib/x86_64-linux-gnu/libtk8.6.so
#20 0x00007f1833ddff2f in Tcl_ServiceEvent () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#21 0x00007f1833de0195 in Tcl_DoOneEvent () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#22 0x00007f1832d057c2 in Tk_MainLoop () from
/usr/lib/x86_64-linux-gnu/libtk8.6.so
#23 0x00007f1833dda151 in Tcl_MainEx () from
/usr/lib/x86_64-linux-gnu/libtcl8.6.so
#24 0x000055be757e97fd in ?? ()
#25 0x00007f18335f509b in __libc_start_main (main=0x55be75771490, argc=2,
argv=0x7ffe87a37a18, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x7ffe87a37a08) at ../csu/libc-start.c:308
#26 0x000055be75775369 in ?? ()
# With debug symbols:
(gdb) set width 0
(gdb) set pagination off
(gdb) bt
#0 0x000055be75810e10 in Engine::UpdatePV (sm=0x7ffe87a2a1a0,
this=0x55be77c71170) at src/engine.h:297
#1 Engine::Search (this=this@entry=0x55be77c71170, depth=depth@entry=1,
alpha=680, alpha@entry=860, beta=beta@entry=861,
tryNullMove=tryNullMove@entry=true) at src/engine.cpp:1628
#2 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=1, alpha=alpha@entry=-861, beta=beta@entry=-860,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#3 0x000055be75810aa8 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=2, alpha=alpha@entry=860, beta=beta@entry=861,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1772
#4 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=2, alpha=alpha@entry=-861, beta=beta@entry=-860,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#5 0x000055be75810aa8 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=3, alpha=860, alpha@entry=31997, beta=beta@entry=31998,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1772
#6 0x000055be75810798 in Engine::Search (this=this@entry=0x55be77c71170,
depth=depth@entry=3, alpha=alpha@entry=-31998, beta=beta@entry=-31997,
tryNullMove=<optimized out>, tryNullMove@entry=true) at src/engine.cpp:1770
#7 0x000055be75812138 in Engine::SearchRoot (this=this@entry=0x55be77c71170,
depth=depth@entry=4, alpha=31997, alpha@entry=31962, beta=beta@entry=32032,
mlist=mlist@entry=0x7ffe87a32710) at src/engine.cpp:1531
#8 0x000055be75812ec3 in Engine::Think (this=<optimized out>,
mlist=0x7ffe87a32710) at src/engine.cpp:1449
#9 0x000055be757dd38a in sc_pos_bestSquare (ti=0x55be760ba000, argv=<optimized
out>, argc=<optimized out>, cd=<optimized out>) at src/tkscid.cpp:6056
#10 0x000055be757e4f49 in sc_pos_bestSquare (argv=0x55be77aa2420, argc=3,
ti=0x55be760ba000, cd=0x0) at /usr/include/c++/6/bits/stl_algo.h:1887
#11 sc_pos (cd=0x0, ti=0x55be760ba000, argc=3, argv=0x55be77aa2420) at
src/tkscid.cpp:5725
#12 0x00007f1833d161bb in TclInvokeStringCommand (clientData=0x55be760f9fe0,
interp=0x55be760ba000, objc=3, objv=0x55be77aa2400) at ./generic/tclBasic.c:2479
#13 0x00007f1833d17f87 in TclNRRunCallbacks
(interp=interp@entry=0x55be760ba000, result=0, rootPtr=0x0) at
./generic/tclBasic.c:4461
#14 0x00007f1833d1798f in Tcl_EvalObjv (interp=interp@entry=0x55be760ba000,
objc=objc@entry=2, objv=objv@entry=0x55be77aa2160, flags=flags@entry=2097168)
at ./generic/tclBasic.c:4189
#15 0x00007f1833d1937f in TclEvalEx (interp=0x55be760ba000,
script=0x7ffe87a36f30 "enterSquare 52", numBytes=<optimized out>,
flags=<optimized out>, line=line@entry=1, clNextOuter=clNextOuter@entry=0x0,
outerScript=0x7ffe87a36f30 "enterSquare 52") at ./generic/tclBasic.c:5330
#16 0x00007f1833d18ce3 in Tcl_EvalEx (interp=<optimized out>, script=<optimized
out>, numBytes=<optimized out>, flags=<optimized out>) at
./generic/tclBasic.c:4995
#17 0x00007f1832cf57bd in Tk_BindEvent (bindPtr=<optimized out>,
eventPtr=eventPtr@entry=0x7ffe87a370c0, tkwin=0x55be77914e30,
numObjects=<optimized out>, objectPtr=<optimized out>,
objectPtr@entry=0x55be77c613a0) at ./unix/../generic/tkBind.c:1518
#18 0x00007f1832d47fd8 in CanvasDoEvent
(canvasPtr=canvasPtr@entry=0x55be76593340,
eventPtr=eventPtr@entry=0x7ffe87a370c0) at ./unix/../generic/tkCanvas.c:5228
#19 0x00007f1832d479f9 in PickCurrentItem
(canvasPtr=canvasPtr@entry=0x55be76593340,
eventPtr=eventPtr@entry=0x55be77952130) at ./unix/../generic/tkCanvas.c:5046
#20 0x00007f1832d47674 in CanvasBindProc (clientData=0x55be76593340,
eventPtr=0x55be77952130) at ./unix/../generic/tkCanvas.c:4824
#21 0x00007f1832d04b1f in Tk_HandleEvent
(eventPtr=eventPtr@entry=0x55be77952130) at ./unix/../generic/tkEvent.c:1352
#22 0x00007f1832d05360 in WindowEventProc (flags=<optimized out>,
evPtr=0x55be77952130) at ./unix/../generic/tkEvent.c:1764
#23 WindowEventProc (evPtr=evPtr@entry=0x55be77952120, flags=flags@entry=-3) at
./unix/../generic/tkEvent.c:1735
#24 0x00007f1833ddff2f in Tcl_ServiceEvent (flags=flags@entry=-3) at
./generic/tclNotify.c:670
#25 0x00007f1833de0195 in Tcl_DoOneEvent (flags=-3) at ./generic/tclNotify.c:903
#26 0x00007f1832d057c2 in Tk_MainLoop () at ./unix/../generic/tkEvent.c:2148
#27 0x00007f1833dda151 in Tcl_MainEx (argc=<optimized out>, argv=<optimized
out>, appInitProc=0x55be757e7de0 <UI_impl::initTclTk(Tcl_Interp*)>,
interp=0x55be760ba000) at ./generic/tclMain.c:607
#28 0x000055be757e97fd in UI_impl::Main (argc=2, argv=0x7ffe87a37a18,
exit=<optimized out>) at src/ui_tcltk.h:60
#29 0x00007f18335f509b in __libc_start_main (main=0x55be75771490 <main(int,
char**)>, argc=2, argv=0x7ffe87a37a18, init=<optimized out>, fini=<optimized
out>, rtld_fini=<optimized out>, stack_end=0x7ffe87a37a08) at
../csu/libc-start.c:308
#30 0x000055be75775369 in _start ()
(gdb) disassemble $pc-0x60,$pc+0x10
Dump of assembler code from 0x55be75810db0 to 0x55be75810e20:
0x000055be75810db0 <Engine::Search(int, int, int, bool)+3424>: (bad)
0x000055be75810db1 <Engine::Search(int, int, int, bool)+3425>: incl
0x42(%rbp,%rcx,4)
0x000055be75810db5 <Engine::Search(int, int, int, bool)+3429>: add
%eax,-0x77(%rcx)
0x000055be75810db8 <Engine::Search(int, int, int, bool)+3432>: rorb
%cl,-0x75(%rax)
0x000055be75810dbb <Engine::Search(int, int, int, bool)+3435>: rex.WR
and $0x60,%al
0x000055be75810dbe <Engine::Search(int, int, int, bool)+3438>: imul
$0x294,%r10,%rax
0x000055be75810dc5 <Engine::Search(int, int, int, bool)+3445>: mov
0x68(%rsp),%rbx
0x000055be75810dca <Engine::Search(int, int, int, bool)+3450>: mov
%r8,%rdx
0x000055be75810dcd <Engine::Search(int, int, int, bool)+3453>: imul
$0x284,%r8,%r8
0x000055be75810dd4 <Engine::Search(int, int, int, bool)+3460>: mov
%rcx,0x6870(%r15,%rax,1)
0x000055be75810ddc <Engine::Search(int, int, int, bool)+3468>: mov
%rbx,0x6878(%r15,%rax,1)
0x000055be75810de4 <Engine::Search(int, int, int, bool)+3476>: lea
(%r15,%r8,1),%r9
0x000055be75810de8 <Engine::Search(int, int, int, bool)+3480>: mov
0x686c(%r9),%eax
0x000055be75810def <Engine::Search(int, int, int, bool)+3487>: cmp
%eax,%edx
0x000055be75810df1 <Engine::Search(int, int, int, bool)+3489>: jae
0x55be75810e3b <Engine::Search(int, int, int, bool)+3563>
0x000055be75810df3 <Engine::Search(int, int, int, bool)+3491>: imul
$0x284,%r10,%r11
0x000055be75810dfa <Engine::Search(int, int, int, bool)+3498>: nopw
0x0(%rax,%rax,1)
0x000055be75810e00 <Engine::Search(int, int, int, bool)+3504>: mov
%edx,%eax
0x000055be75810e02 <Engine::Search(int, int, int, bool)+3506>: add
$0x1,%edx
0x000055be75810e05 <Engine::Search(int, int, int, bool)+3509>: shl
$0x4,%rax
0x000055be75810e09 <Engine::Search(int, int, int, bool)+3513>: lea
(%rax,%r11,1),%rcx
0x000055be75810e0d <Engine::Search(int, int, int, bool)+3517>: add
%r8,%rax
=> 0x000055be75810e10 <Engine::Search(int, int, int, bool)+3520>: mov
0x6870(%r15,%rax,1),%rsi
0x000055be75810e18 <Engine::Search(int, int, int, bool)+3528>: mov
0x6878(%r15,%rax,1),%rdi
End of assembler dump.
(gdb) print/x $rax
$1 = 0x1561c
(gdb) print/x $r15
$2 = 0x55be77c71170 -> this?
(gdb) print/x $rsi
$3 = 0x0
(gdb) print/x $r8
$4 = 0x119c
(gdb) list engine.h:283,300
283
284 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~
285 // Engine::UpdatePV
286 // Updates the principal variation at the current Ply to
287 // include the specified move.
288 inline void
289 Engine::UpdatePV (simpleMoveT * sm)
290 {
291 if (Ply >= ENGINE_MAX_PLY - 1) { return; }
292 if (InNullMove > 0) { return; }
293 // if (! Pos.IsLegalMove (sm)) { return; }
294
295 PV[Ply].move[Ply] = *sm;
296 for (uint j = Ply + 1; j < PV[Ply + 1].length; j++) {
297 PV[Ply].move[j] = PV[Ply+1].move[j];
298 }
299 PV[Ply].length = PV[Ply+1].length;
300 }
(gdb) print Ply
$5 = 6
(gdb) print j
$6 = 5193
(gdb) print/x j
$7 = 0x1449
(gdb) print PV[Ply + 1].length
$8 = 4283979864
(gdb) print/x PV[Ply + 1].length
$9 = 0xff585858
(gdb) print/x PV[0].length
$10 = 0x3
(gdb) print/x PV[1].length
$11 = 0x1
(gdb) print/x PV[2].length
$12 = 0x6
(gdb) print/x PV[3].length
$13 = 0x3
(gdb) print/x PV[4].length
$14 = 0x6
(gdb) print/x PV[5].length
$15 = 0x5
(gdb) print/x PV[6].length
$16 = 0x6
(gdb) print/x PV[7].length
$17 = 0xff585858
set width 0
set pagination off
directory /home/benutzer/source/scid/orig/scid-4.6.4+dfsg1
#valgrind --trace-children=yes scid
#valgrind --vgdb=yes --vgdb-error=0 /usr/games/tkscid /usr/games/scid
valgrind --vgdb=yes --vgdb-error=0 --track-origins=yes /usr/games/tkscid
/usr/games/scid
gdb -q \
-ex 'set width 0' \
-ex 'set pagination off' \
-ex 'directory /home/benutzer/source/libx11-6/orig/libx11-1.6.7/1/2/3/4' \
-ex 'directory /home/benutzer/source/libx11-6/orig/libx11-1.6.7/1/2/3' \
-ex 'directory /home/benutzer/source/scid/orig/scid-4.6.4+dfsg1' \
-ex 'target remote | vgdb' \
-ex 'cont' \
/usr/games/tkscid
benutzer@debian:~$ valgrind --vgdb=yes --vgdb-error=0 /usr/games/tkscid
/usr/games/scid
==26514== Memcheck, a memory error detector
==26514== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==26514== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==26514== Command: /usr/games/tkscid /usr/games/scid
==26514==
==26514== (action at startup) vgdb me ...
==26514==
==26514== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==26514== /path/to/gdb /usr/games/tkscid
==26514== and then give GDB the following command
==26514== target remote | /usr/lib/x86_64-linux-gnu/valgrind/../../bin/vgdb
--pid=26514
==26514== --pid is optional if only one valgrind process is running
==26514==
==26514== Invalid read of size 1
==26514== at 0x4839D03: strcmp (vg_replace_strmem.c:848)
==26514== by 0x6121ECE: _XimUnRegisterIMInstantiateCallback (imInsClbk.c:238)
==26514== by 0x61093E0: XUnregisterIMInstantiateCallback (IMWrap.c:200)
==26514== by 0x6121D8D: _XimRegisterIMInstantiateCallback (imInsClbk.c:209)
==26514== by 0x610935A: XRegisterIMInstantiateCallback (IMWrap.c:177)
==26514== by 0x5D30B1B: TkpOpenDisplay (tkUnixEvent.c:184)
==26514== by 0x5C99D11: GetScreen (tkWindow.c:465)
==26514== by 0x5C99B7F: CreateTopLevelWindow (tkWindow.c:348)
==26514== by 0x5C9A54B: TkCreateMainWindow (tkWindow.c:854)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:582)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:474)
==26514== by 0x5CA4927: TkListCreateFrame (tkFrame.c:468)
==26514== by 0x5C9C9BC: Initialize (tkWindow.c:3254)
==26514== Address 0x58d7400 is 0 bytes inside a block of size 1 free'd
==26514== at 0x48369AB: free (vg_replace_malloc.c:530)
==26514== by 0x61183BC: XSetLocaleModifiers (lcWrap.c:89)
==26514== by 0x5D31266: OpenIM (tkUnixEvent.c:725)
==26514== by 0x5D311EB: InstantiateIMCallback (tkUnixEvent.c:680)
==26514== by 0x6121D8D: _XimRegisterIMInstantiateCallback (imInsClbk.c:209)
==26514== by 0x610935A: XRegisterIMInstantiateCallback (IMWrap.c:177)
==26514== by 0x5D30B1B: TkpOpenDisplay (tkUnixEvent.c:184)
==26514== by 0x5C99D11: GetScreen (tkWindow.c:465)
==26514== by 0x5C99B7F: CreateTopLevelWindow (tkWindow.c:348)
==26514== by 0x5C9A54B: TkCreateMainWindow (tkWindow.c:854)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:582)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:474)
==26514== by 0x5CA4927: TkListCreateFrame (tkFrame.c:468)
==26514== Block was alloc'd at
==26514== at 0x483577F: malloc (vg_replace_malloc.c:299)
==26514== by 0x6117FB4: _XlcDefaultMapModifiers (lcWrap.c:146)
==26514== by 0x61183A5: XSetLocaleModifiers (lcWrap.c:87)
==26514== by 0x5D31266: OpenIM (tkUnixEvent.c:725)
==26514== by 0x5D30B03: TkpOpenDisplay (tkUnixEvent.c:183)
==26514== by 0x5C99D11: GetScreen (tkWindow.c:465)
==26514== by 0x5C99B7F: CreateTopLevelWindow (tkWindow.c:348)
==26514== by 0x5C9A54B: TkCreateMainWindow (tkWindow.c:854)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:582)
==26514== by 0x5CA4F2D: CreateFrame (tkFrame.c:474)
==26514== by 0x5CA4927: TkListCreateFrame (tkFrame.c:468)
==26514== by 0x5C9C9BC: Initialize (tkWindow.c:3254)
==26514== by 0x4951F38: Tcl_LoadObjCmd (tclLoad.c:464)
==26514==
==26514== (action on error) vgdb me ...
benutzer@debian:~$ gdb -q -ex 'set width 0' -ex 'set pagination off' -ex
'target remote | vgdb' -ex 'cont' /usr/games/tkscid
Reading symbols from /usr/games/tkscid...Reading symbols from
/usr/lib/debug/.build-id/b7/f74f5bf2959827772fafc05999c01740e78baa.debug...done.
done.
Remote debugging using | vgdb
relaying data between gdb and process 26514
warning: remote target does not support file transfer, attempting to access
files from local filesystem.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from
/usr/lib/debug/.build-id/dd/8026f43793facd0aa3924fb2dd6b0033b7b431.debug...done.
done.
0x0000000004001090 in _start () from /lib64/ld-linux-x86-64.so.2
Continuing.
Program received signal SIGTRAP, Trace/breakpoint trap.
_vgr20160ZU_libcZdsoZa_strcmp (s1=0x72b9210 "", s2=0x58d7400 "") at
../shared/vg_replace_strmem.c:848
848 ../shared/vg_replace_strmem.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0 _vgr20160ZU_libcZdsoZa_strcmp (s1=0x72b9210 "", s2=0x58d7400 "") at
../shared/vg_replace_strmem.c:848
#1 0x0000000006121ecf in _XimUnRegisterIMInstantiateCallback (lcd=0x58b4aa0,
display=0x58a26b0, rdb=0x0, res_name=0x0, res_class=0x0, callback=0x5d311e0
<InstantiateIMCallback>, client_data=0x587fe60 "\260&\212\005") at
../../../../modules/im/ximcp/imInsClbk.c:235
#2 0x00000000061093e1 in XUnregisterIMInstantiateCallback (display=0x58a26b0,
rdb=0x0, res_name=0x0, res_class=0x0, callback=0x5d311e0
<InstantiateIMCallback>, client_data=0x587fe60 "\260&\212\005") at
../../../src/xlibi18n/IMWrap.c:200
#3 0x0000000006121d8e in _XimRegisterIMInstantiateCallback (lcd=<optimized
out>, display=0x58a26b0, rdb=0x0, res_name=<optimized out>, res_class=0x0,
callback=0x5d311e0 <InstantiateIMCallback>, client_data=0x587fe60
"\260&\212\005") at ../../../../modules/im/ximcp/imInsClbk.c:209
#4 0x000000000610935b in XRegisterIMInstantiateCallback (display=0x58a26b0,
rdb=rdb@entry=0x0, res_name=res_name@entry=0x0, res_class=res_class@entry=0x0,
callback=callback@entry=0x5d311e0 <InstantiateIMCallback>,
client_data=client_data@entry=0x587fe60 "\260&\212\005") at
../../../src/xlibi18n/IMWrap.c:177
#5 0x0000000005d30b1c in TkpOpenDisplay
(displayNameStr=displayNameStr@entry=0x581def0 ":0") at
./unix/../unix/tkUnixEvent.c:184
#6 0x0000000005c99d12 in GetScreen (interp=interp@entry=0x568bd50,
screenName=0x581def0 ":0", screenName@entry=0x5d50d77 "",
screenPtr=screenPtr@entry=0x1ffefff074) at ./unix/../generic/tkWindow.c:465
#7 0x0000000005c99b80 in CreateTopLevelWindow (interp=interp@entry=0x568bd50,
parent=parent@entry=0x0, name=name@entry=0x56d7370 "scid",
screenName=screenName@entry=0x5d50d77 "", flags=flags@entry=0) at
./unix/../generic/tkWindow.c:348
#8 0x0000000005c9a54c in TkCreateMainWindow (interp=interp@entry=0x568bd50,
screenName=screenName@entry=0x5d50d77 "", baseName=baseName@entry=0x56d7370
"scid") at ./unix/../generic/tkWindow.c:854
#9 0x0000000005ca4f2e in CreateFrame (clientData=<optimized out>,
appName=0x56d7370 "scid", type=TYPE_TOPLEVEL, objv=0x56b5ca0, objc=4,
interp=0x568bd50) at ./unix/../generic/tkFrame.c:582
#10 CreateFrame (clientData=<optimized out>, interp=0x568bd50, objc=4,
objv=0x56b5ca0, type=TYPE_TOPLEVEL, appName=0x56d7370 "scid") at
./unix/../generic/tkFrame.c:474
#11 0x0000000005ca4928 in TkListCreateFrame (clientData=clientData@entry=0x0,
interp=interp@entry=0x568bd50, listObj=listObj@entry=0x550c680,
toplevel=toplevel@entry=1, nameObj=0x550c350) at ./unix/../generic/tkFrame.c:468
#12 0x0000000005c9c9bd in Initialize (interp=0x568bd50) at
./unix/../generic/tkWindow.c:3254
#13 0x0000000004951f39 in Tcl_LoadObjCmd (dummy=<optimized out>,
interp=<optimized out>, objc=<optimized out>, objv=<optimized out>) at
./generic/tclLoad.c:464
#14 0x0000000004890f87 in TclNRRunCallbacks (interp=interp@entry=0x568bd50,
result=0, rootPtr=0x0) at ./generic/tclBasic.c:4461
#15 0x000000000489098f in Tcl_EvalObjv (interp=interp@entry=0x568bd50,
objc=objc@entry=4, objv=objv@entry=0x5690070, flags=flags@entry=2097168) at
./generic/tclBasic.c:4189
#16 0x000000000489237f in TclEvalEx (interp=interp@entry=0x568bd50,
script=0x56b9bd0 "#!/bin/sh\n\n# Scid (Shane's Chess Information
Database)\n#\n# Copyright (C) 1999-2004 Shane Hudson\n# Copyright (C) 2006-2009
Pascal Georges\n# Copyright (C) 2008-2011 Alexander Wagner\n# Copyright (C)
2013"..., numBytes=<optimized out>, flags=flags@entry=0, line=37, line@entry=1,
clNextOuter=clNextOuter@entry=0x0, outerScript=0x56b9bd0 "#!/bin/sh\n\n# Scid
(Shane's Chess Information Database)\n#\n# Copyright (C) 1999-2004 Shane
Hudson\n# Copyright (C) 2006-2009 Pascal Georges\n# Copyright (C) 2008-2011
Alexander Wagner\n# Copyright (C) 2013"...) at ./generic/tclBasic.c:5330
#17 0x000000000494b348 in Tcl_FSEvalFileEx (encodingName=<optimized out>,
pathPtr=0x550af70, interp=0x568bd50) at ./generic/tclIOUtil.c:1824
#18 Tcl_FSEvalFileEx (interp=interp@entry=0x568bd50,
pathPtr=pathPtr@entry=0x550af70, encodingName=<optimized out>) at
./generic/tclIOUtil.c:1724
#19 0x00000000049531a7 in Tcl_MainEx (argc=<optimized out>, argv=<optimized
out>, appInitProc=0x189de0 <UI_impl::initTclTk(Tcl_Interp*)>, interp=0x568bd50)
at ./generic/tclMain.c:420
#20 0x000000000018b7fd in UI_impl::Main (argc=2, argv=0x1fff0004d8,
exit=<optimized out>) at src/ui_tcltk.h:60
#21 0x0000000004f7a09b in __libc_start_main (main=0x113490 <main(int, char**)>,
argc=2, argv=0x1fff0004d8, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>, stack_end=0x1fff0004c8) at ../csu/libc-start.c:308
#22 0x0000000000117369 in _start ()
(gdb)
(gdb) up
#1 0x0000000006121ecf in _XimUnRegisterIMInstantiateCallback (lcd=0x58b4aa0,
display=0x58a26b0, rdb=0x0, res_name=0x0, res_class=0x0, callback=0x5d311e0
<InstantiateIMCallback>, client_data=0x587fe60 "\260&\212\005") at
../../../../modules/im/ximcp/imInsClbk.c:235
(gdb) list 216,250
216 Bool
217 _XimUnRegisterIMInstantiateCallback(
218 XLCd lcd,
219 Display *display,
220 XrmDatabase rdb,
221 char *res_name,
222 char *res_class,
223 XIDProc callback,
224 XPointer client_data)
225 {
226 char locale[XIM_MAXLCNAMELEN];
227 XimInstCallback icb, picb;
228
229 if( !callback_list )
230 return( False );
231
232 MakeLocale( lcd, locale );
233
234 for( icb = callback_list, picb = NULL; icb; picb = icb, icb =
icb->next ) {
235 if( !strcmp( locale, icb->name ) &&
236 (lcd->core->modifiers == icb->modifiers || /*
XXXXX */
237 (lcd->core->modifiers && icb->modifiers &&
238 !strcmp( lcd->core->modifiers, icb->modifiers ))) &&
239 rdb == icb->rdb && /*
XXXXX */
240 ((res_name == NULL && icb->res_name == NULL) ||
241 (res_name != NULL && icb->res_name != NULL &&
242 !strcmp( res_name, icb->res_name ))) &&
243 ((res_class == NULL && icb->res_class == NULL) ||
244 (res_class != NULL && icb->res_class != NULL &&
245 !strcmp( res_class, icb->res_class ))) &&
246 (callback == icb->callback) &&
247 (client_data == icb->client_data) && /*
XXXXX */
248 !icb->destroy ) {
249 if( lock )
250 icb->destroy = True;
(gdb) print lcd->core->modifiers
$7 = 0x72b9210 ""
(gdb) print icb->modifiers
$8 = 0x58d7400 ""
(gdb) list XSetLocaleModifiers
73
74 char *
75 XSetLocaleModifiers(
76 const char *modifiers)
77 {
78 XLCd lcd = _XlcCurrentLC();
79 char *user_mods;
80 char *mapped_mods;
81
82 if (!lcd)
83 return (char *) NULL;
84 if (!modifiers)
85 return lcd->core->modifiers;
86 user_mods = getenv("XMODIFIERS");
87 mapped_mods = (*lcd->methods->map_modifiers) (lcd, user_mods,
modifiers);
88 if (mapped_mods) {
89 Xfree(lcd->core->modifiers);
90 lcd->core->modifiers = mapped_mods;
91 }
92 return mapped_mods;
93 }
--> Looks wrong but still unrelated ...
#########
benutzer@debian:~$ valgrind --vgdb=yes --vgdb-error=0 --track-origins=yes
/usr/games/tkscid /usr/games/scid
==26628== Memcheck, a memory error detector
==26628== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==26628== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==26628== Command: /usr/games/tkscid /usr/games/scid
==26628==
==26628== (action at startup) vgdb me ...
==26628==
==26628== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==26628== /path/to/gdb /usr/games/tkscid
==26628== and then give GDB the following command
==26628== target remote | /usr/lib/x86_64-linux-gnu/valgrind/../../bin/vgdb
--pid=26628
==26628== --pid is optional if only one valgrind process is running
==26628==
==26628== Invalid read of size 1
...
==26628==
==26628== (action on error) vgdb me ...
==26628== Continuing ...
==26628== Conditional jump or move depends on uninitialised value(s)
==26628== at 0x1AEA45: Engine::ScorePawnStructure(pawnTableEntryT*)
(engine.cpp:741)
==26628== by 0x1AED6F: Engine::Score(int, int) (engine.cpp:412)
==26628== by 0x1B15D3: Engine::Quiesce(int, int) [clone .part.28]
(engine.cpp:1890)
==26628== by 0x1B4B92: Quiesce (engine.cpp:2323)
==26628== by 0x1B4B92: Engine::Think(MoveList*) (engine.cpp:1407)
==26628== by 0x17F389: sc_pos_bestSquare(void*, Tcl_Interp*, int, char
const**) [clone .part.418] (tkscid.cpp:6056)
==26628== by 0x186F48: sc_pos_bestSquare (stl_algo.h:1887)
==26628== by 0x186F48: sc_pos(void*, Tcl_Interp*, int, char const**)
(tkscid.cpp:5725)
==26628== by 0x488F1BA: TclInvokeStringCommand (tclBasic.c:2479)
==26628== by 0x4890F86: TclNRRunCallbacks (tclBasic.c:4461)
==26628== by 0x489237E: TclEvalEx (tclBasic.c:5330)
==26628== by 0x4891CE2: Tcl_EvalEx (tclBasic.c:4995)
==26628== by 0x5C6C7BC: Tk_BindEvent (tkBind.c:1518)
==26628== by 0x5CBEFD7: CanvasDoEvent (tkCanvas.c:5228)
==26628== Uninitialised value was created by a heap allocation
==26628== at 0x483650F: operator new[](unsigned long)
(vg_replace_malloc.c:423)
==26628== by 0x1B0315: Engine::SetPawnTableKilobytes(unsigned int)
(engine.cpp:1114)
==26628== by 0x17F2C2: Engine (engine.h:206)
==26628== by 0x17F2C2: sc_pos_bestSquare(void*, Tcl_Interp*, int, char
const**) [clone .part.418] (tkscid.cpp:6053)
==26628== by 0x186F48: sc_pos_bestSquare (stl_algo.h:1887)
==26628== by 0x186F48: sc_pos(void*, Tcl_Interp*, int, char const**)
(tkscid.cpp:5725)
==26628== by 0x488F1BA: TclInvokeStringCommand (tclBasic.c:2479)
==26628== by 0x4890F86: TclNRRunCallbacks (tclBasic.c:4461)
==26628== by 0x489237E: TclEvalEx (tclBasic.c:5330)
==26628== by 0x4891CE2: Tcl_EvalEx (tclBasic.c:4995)
==26628== by 0x5C6C7BC: Tk_BindEvent (tkBind.c:1518)
==26628== by 0x5CBEFD7: CanvasDoEvent (tkCanvas.c:5228)
==26628== by 0x5CBE9F8: PickCurrentItem (tkCanvas.c:5046)
==26628== by 0x5CBE673: CanvasBindProc (tkCanvas.c:4824)
==26628==
==26628== (action on error) vgdb me ...
