54 lines
3.1 KiB
Plaintext
54 lines
3.1 KiB
Plaintext
# Memcheck suppressions for the Flan corpus. See test/test_valgrind.ml.
|
|
#
|
|
# This file is empty of suppressions, and that is a finding rather than an
|
|
# oversight. The sweep was run over forty-nine programs with
|
|
# --gen-suppressions=all before this file existed, checked and again with
|
|
# --no-bounds-checks, and memcheck produced nothing to suppress: no false
|
|
# positives, and no true ones either. Every entry below the line would have
|
|
# been written from valgrind's own --gen-suppressions output plus a reason;
|
|
# none was needed.
|
|
#
|
|
# The four complaints that were expected, and why none of them appeared:
|
|
#
|
|
# 1. The arena's alignment padding, and the gap between its offset and its
|
|
# capacity. Expected to show as uninitialised reads. It cannot, and the
|
|
# reason is structural rather than lucky: the arena is a single
|
|
# malloc(cap), so every byte in it — handed out, padding, or still past
|
|
# the offset — is one allocation to memcheck. It never learns that a
|
|
# sub-object ended, so it has nothing to complain about and equally
|
|
# nothing to catch. Recorded as a coverage ceiling in docs/BUILT.md, not as a
|
|
# clean bill of health.
|
|
#
|
|
# What *is* caught is definedness rather than addressability, and that
|
|
# half now covers the arena too: flan_arena_proc's free-all issues
|
|
# memcheck's MAKE_MEM_UNDEFINED over the whole capacity, so a read of
|
|
# bytes a previous round wrote before the reset reports. test_valgrind.ml
|
|
# asserts it as a control — it produced nothing before the runtime change
|
|
# and six errors after. The corpus stayed clean across that change, and
|
|
# the sharp end of that is stale-region.flan, map-stale-region.flan and
|
|
# pool-stale-region.flan: all three read through a pointer into an arena
|
|
# that has been reset, all three are now reading bytes memcheck knows are
|
|
# undefined, and none of them reports — because the epoch trap fires
|
|
# first. The runtime's own guard beats the read. Interior overruns are
|
|
# still invisible, for the structural reason above.
|
|
#
|
|
# 2. Hand-written LLVM IR. Expected to confuse the tool. It does not, and it
|
|
# could not: memcheck instruments the binary, so it never sees IR, never
|
|
# sees a frontend attribute, and cannot tell Emit's output from clang's.
|
|
# This is the whole reason it was reachable here when MSan was not.
|
|
#
|
|
# 3. `zeroed` storage. A zeroed defvar is in .bss, which memcheck treats as
|
|
# defined because it is — the kernel supplies zeroes. No complaint, and
|
|
# correctly so.
|
|
#
|
|
# 4. Struct padding in a Map key. The compiler emits a per-key-type hash and
|
|
# equality pair that walks fields rather than bytes, so the holes are
|
|
# never read. test_valgrind.ml asserts this directly with a key carrying
|
|
# two seven-byte holes: it must not report, and a suppression here would
|
|
# have destroyed the one control that proves the pair is correct.
|
|
#
|
|
# The rule for adding to this file: paste valgrind's own --gen-suppressions
|
|
# text, and write above it why the report is not a bug. A suppression without
|
|
# a reason is how a real defect gets silenced later, and an empty file is a
|
|
# better outcome than a speculative one.
|