Problem report #90

[Dan Nicolaescu]

CID: 90
Checker: UNINIT (help)
File: base/src/emacs/src/eval.c
Function: Ffuncall
Description: Using uninitialized value "val"

Event var_decl: Declared variable "val" without initializer
Also see events: [uninit_use]

2839      Lisp_Object val;
2840      struct backtrace backtrace;
2841      register Lisp_Object *internal_args;
2842      register int i;
2843    
2844      QUIT;
2845      if ((consing_since_gc > gc_cons_threshold
2846           && consing_since_gc > gc_relative_threshold)
2847          ||
2848          (!NILP (Vmemory_full) && consing_since_gc > 
memory_full_cons_threshold))
2849        Fgarbage_collect ();
2850    
2851      if (++lisp_eval_depth > max_lisp_eval_depth)
2852        {
2853          if (max_lisp_eval_depth < 100)
2854            max_lisp_eval_depth = 100;
2855          if (lisp_eval_depth > max_lisp_eval_depth)
2856            error ("Lisp nesting exceeds `max-lisp-eval-depth'");
2857        }
2858    
2859      backtrace.next = backtrace_list;
2860      backtrace_list = &backtrace;
2861      backtrace.function = &args[0];
2862      backtrace.args = &args[1];
2863      backtrace.nargs = nargs - 1;
2864      backtrace.evalargs = 0;
2865      backtrace.debug_on_exit = 0;
2866    
2867      if (debug_on_next_call)
2868        do_debug_on_call (Qlambda);
2869    
2870      CHECK_CONS_LIST ();
2871    
2872      original_fun = args[0];
2873    
2874     retry:
2875    
2876      /* Optimize for no indirection.  */
2877      fun = original_fun;

At conditional (9): "fun & 7 == 1" taking true path
At conditional (10): "fun != Qunbound" taking true path
At conditional (11): "(fun = ((0), (fun & -8))->function), (fun & 7 == 1)" 
taking true path

2878      if (SYMBOLP (fun) && !EQ (fun, Qunbound)
2879          && (fun = XSYMBOL (fun)->function, SYMBOLP (fun)))
2880        fun = indirect_function (fun);
2881    

At conditional (1): "((0), (fun & -8))->size & 1073758208 == 1073758208" taking 
false path
At conditional (12): "fun & 7 == 4" taking true path
At conditional (13): "((0), (fun & -8))->size & 1073758208 == 1073758208" 
taking false path

2882      if (SUBRP (fun))
2883        {
2884           if (numargs < XSUBR (fun)->min_args
2885              || (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args < 
numargs))
2886            {
2887              XSETFASTINT (lisp_numargs, numargs);
2888              Fsignal (Qwrong_number_of_arguments, list2 (original_fun, 
lisp_numargs));
2889            }
2890    
2891          if (XSUBR (fun)->max_args == UNEVALLED)
2892            Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2893    
2894          if (XSUBR (fun)->max_args == MANY)
2895            {
2896              val = (*XSUBR (fun)->function) (numargs, args + 1);
2897              goto done;
2898            }
2899    
2900          if (XSUBR (fun)->max_args > numargs)
2901            {
2902              internal_args = (Lisp_Object *) alloca (XSUBR (fun)->max_args 
* sizeof (Lisp_Object));
2903              bcopy (args + 1, internal_args, numargs * sizeof 
(Lisp_Object));
2904              for (i = numargs; i < XSUBR (fun)->max_args; i++)
2905                internal_args[i] = Qnil;
2906            }
2907          else
2908            internal_args = args + 1;
2909          switch (XSUBR (fun)->max_args)
2910            {
2911            case 0:
2912              val = (*XSUBR (fun)->function) ();
2913              goto done;
2914            case 1:
2915              val = (*XSUBR (fun)->function) (internal_args[0]);
2916              goto done;
2917            case 2:
2918              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1]);
2919              goto done;
2920            case 3:
2921              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2922                                              internal_args[2]);
2923              goto done;
2924            case 4:
2925              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2926                                              internal_args[2], 
internal_args[3]);
2927              goto done;
2928            case 5:
2929              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2930                                              internal_args[2], 
internal_args[3],
2931                                              internal_args[4]);
2932              goto done;
2933            case 6:
2934              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2935                                              internal_args[2], 
internal_args[3],
2936                                              internal_args[4], 
internal_args[5]);
2937              goto done;
2938            case 7:
2939              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2940                                              internal_args[2], 
internal_args[3],
2941                                              internal_args[4], 
internal_args[5],
2942                                              internal_args[6]);
2943              goto done;
2944    
2945            case 8:
2946              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
2947                                              internal_args[2], 
internal_args[3],
2948                                              internal_args[4], 
internal_args[5],
2949                                              internal_args[6], 
internal_args[7]);
2950              goto done;
2951    
2952            default:
2953    
2954              /* If a subr takes more than 8 arguments without using MANY
2955                 or UNEVALLED, we need to extend this function to support 
it.
2956                 Until this is done, there is no way to call the function.  
*/
2957              abort ();
2958            }
2959        }

At conditional (2): "fun & 7 == 4" taking true path
At conditional (3): "((0), (fun & -8))->size & 1073743872 == 1073743872" taking 
false path
At conditional (14): "fun & 7 == 4" taking true path
At conditional (15): "((0), (fun & -8))->size & 1073743872 == 1073743872" 
taking false path

2960      if (COMPILEDP (fun))
2961        val = funcall_lambda (fun, numargs, args + 1);
2962      else
2963        {

At conditional (4): "fun == Qunbound" taking true path
At conditional (16): "fun == Qunbound" taking true path

2964          if (EQ (fun, Qunbound))
2965            Fsignal (Qvoid_function, Fcons (original_fun, Qnil));

At conditional (5): "fun & 7 != 5" taking true path
At conditional (17): "fun & 7 != 5" taking true path

2966          if (!CONSP (fun))
2967            Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2968          funcar = Fcar (fun);

At conditional (6): "funcar & 7 != 1" taking true path
At conditional (18): "funcar & 7 != 1" taking true path

2969          if (!SYMBOLP (funcar))
2970            Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));

At conditional (7): "funcar == Qlambda" taking false path
At conditional (19): "funcar == Qlambda" taking false path

2971          if (EQ (funcar, Qlambda))
2972            val = funcall_lambda (fun, numargs, args + 1);

At conditional (8): "funcar == Qautoload" taking true path
At conditional (20): "funcar == Qautoload" taking false path

2973          else if (EQ (funcar, Qautoload))
2974            {
2975              do_autoload (fun, original_fun);
2976              CHECK_CONS_LIST ();
2977              goto retry;
2978            }
2979          else
2980            Fsignal (Qinvalid_function, Fcons (original_fun, Qnil));
2981        }
2982     done:
2983      CHECK_CONS_LIST ();
2984      lisp_eval_depth--;

At conditional (21): "(backtrace).debug_on_exit != 0" taking false path

2985      if (backtrace.debug_on_exit)
2986        val = call_debugger (Fcons (Qexit, Fcons (val, Qnil)));
2987      backtrace_list = backtrace.next;

Event uninit_use: Using uninitialized value "val"
Also see events: [var_decl]

2988      return val;
2989    }