1 <?xml version="1.0"?> <!-- -*- sgml -*- -->
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
4 [ <!ENTITY % vg-entities SYSTEM "vg-entities.xml"> %vg-entities; ]>
7 <book id="FAQ" xreflabel="Valgrind FAQ">
10 <title>Valgrind FAQ</title>
11 <releaseinfo>&rel-type; &rel-version; &rel-date;</releaseinfo>
13 <year>&vg-lifespan;</year>
14 <holder><ulink url="&vg-devs-url;">Valgrind Developers</ulink></holder>
17 <para>Email: <ulink url="mailto:&vg-vemail;">&vg-vemail;</ulink></para>
23 <title>Valgrind Frequently Asked Questions</title>
26 <!-- FAQ starts here -->
31 <qandadiv id="faq.background" xreflabel="Background">
32 <title>Background</title>
34 <qandaentry id="faq.pronounce">
35 <question id="q-pronounce">
36 <para>How do you pronounce "Valgrind"?</para>
38 <answer id="a-pronounce">
39 <para>The "Val" as in the word "value". The "grind" is pronounced
40 with a short 'i' -- ie. "grinned" (rhymes with "tinned") rather than
41 "grined" (rhymes with "find").</para> <para>Don't feel bad: almost
42 everyone gets it wrong at first.</para>
46 <qandaentry id="faq.whence">
47 <question id="q-whence">
48 <para>Where does the name "Valgrind" come from?</para>
50 <answer id="a-whence">
52 <para>From Nordic mythology. Originally (before release) the project
53 was named Heimdall, after the watchman of the Nordic gods. He could
54 "see a hundred miles by day or night, hear the grass growing, see the
55 wool growing on a sheep's back", etc. This would have been a great
56 name, but it was already taken by a security package "Heimdal".</para>
58 <para>Keeping with the Nordic theme, Valgrind was chosen. Valgrind is
59 the name of the main entrance to Valhalla (the Hall of the Chosen
60 Slain in Asgard). Over this entrance there resides a wolf and over it
61 there is the head of a boar and on it perches a huge eagle, whose eyes
62 can see to the far regions of the nine worlds. Only those judged
63 worthy by the guardians are allowed to pass through Valgrind. All
64 others are refused entrance.</para>
66 <para>It's not short for "value grinder", although that's not a bad
75 <!-- Compiling, Installing and Configuring -->
76 <qandadiv id="faq.installing" xreflabel="Compiling, installing and configuring">
77 <title>Compiling, installing and configuring</title>
79 <qandaentry id="faq.make_dies">
80 <question id="q-make_dies">
81 <para>When building Valgrind, 'make' dies partway with
82 an assertion failure, something like this:</para>
84 % make: expand.c:489: allocated_variable_append:
85 Assertion 'current_variable_set_list->next != 0' failed.
88 <answer id="a-make_dies">
89 <para>It's probably a bug in 'make'. Some, but not all, instances of
90 version 3.79.1 have this bug, see
91 <ulink url="http://www.mail-archive.com/bug-make@gnu.org/msg01658.html">this</ulink>.
92 Try upgrading to a more recent version of 'make'. Alternatively, we have
93 heard that unsetting the CFLAGS environment variable avoids the
98 <qandaentry id="faq.glibc_devel">
100 <para>When building Valgrind, 'make' fails with this:</para>
102 /usr/bin/ld: cannot find -lc
103 collect2: ld returned 1 exit status
107 <para>You need to install the glibc-static-devel package.</para>
114 <!-- Valgrind aborts unexpectedly -->
115 <qandadiv id="faq.abort" xreflabel="Valgrind aborts unexpectedly">
116 <title>Valgrind aborts unexpectedly</title>
118 <qandaentry id="faq.exit_errors">
119 <question id="q-exit_errors">
120 <para>Programs run OK on Valgrind, but at exit produce a bunch of
121 errors involving <literal>__libc_freeres</literal> and then die
122 with a segmentation fault.</para>
124 <answer id="a-exit_errors">
125 <para>When the program exits, Valgrind runs the procedure
126 <function>__libc_freeres</function> in glibc. This is a hook for
127 memory debuggers, so they can ask glibc to free up any memory it has
128 used. Doing that is needed to ensure that Valgrind doesn't
129 incorrectly report space leaks in glibc.</para>
131 <para>The problem is that running <literal>__libc_freeres</literal> in
132 older glibc versions causes this crash.</para>
134 <para>Workaround for 1.1.X and later versions of Valgrind: use the
135 <option>--run-libc-freeres=no</option> option. You may then get space
136 leak reports for glibc allocations (please don't report these to
137 the glibc people, since they are not real leaks), but at least the
142 <qandaentry id="faq.bugdeath">
143 <question id="q-bugdeath">
144 <para>My (buggy) program dies like this:</para>
145 <screen>valgrind: m_mallocfree.c:248 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.</screen>
146 <para>or like this:</para>
147 <screen>valgrind: m_mallocfree.c:442 (mk_inuse_bszB): Assertion 'bszB != 0' failed.</screen>
148 <para>or otherwise aborts or crashes in m_mallocfree.c.</para>
151 <answer id="a-bugdeath">
152 <para>If Memcheck (the memory checker) shows any invalid reads,
153 invalid writes or invalid frees in your program, the above may
154 happen. Reason is that your program may trash Valgrind's low-level
155 memory manager, which then dies with the above assertion, or
156 something similar. The cure is to fix your program so that it
157 doesn't do any illegal memory accesses. The above failure will
158 hopefully go away after that.</para>
162 <qandaentry id="faq.msgdeath">
163 <question id="q-msgdeath">
164 <para>My program dies, printing a message like this along the
166 <screen>vex x86->IR: unhandled instruction bytes: 0x66 0xF 0x2E 0x5</screen>
168 <answer id="a-msgdeath">
169 <para>One possibility is that your program has a bug and erroneously
170 jumps to a non-code address, in which case you'll get a SIGILL signal.
171 Memcheck may issue a warning just before this happens, but it might not
172 if the jump happens to land in addressable memory.</para>
174 <para>Another possibility is that Valgrind does not handle the
175 instruction. If you are using an older Valgrind, a newer version might
176 handle the instruction. However, all instruction sets have some
177 obscure, rarely used instructions. Also, on amd64 there are an almost
178 limitless number of combinations of redundant instruction prefixes, many
179 of them undocumented but accepted by CPUs. So Valgrind will still have
180 decoding failures from time to time. If this happens, please file a bug
185 <qandaentry id="faq.java">
186 <question id="q-java">
187 <para>I tried running a Java program (or another program that uses a
188 just-in-time compiler) under Valgrind but something went wrong.
189 Does Valgrind handle such programs?</para>
192 <para>Valgrind can handle dynamically generated code, so long as
193 none of the generated code is later overwritten by other generated
194 code. If this happens, though, things will go wrong as Valgrind
195 will continue running its translations of the old code (this is true
196 on x86 and amd64, on PowerPC there are explicit cache flush
197 instructions which Valgrind detects and honours).
198 You should try running with
199 <option>--smc-check=all</option> in this case. Valgrind will run
200 much more slowly, but should detect the use of the out-of-date
203 <para>Alternatively, if you have the source code to the JIT compiler
204 you can insert calls to the
205 <computeroutput>VALGRIND_DISCARD_TRANSLATIONS</computeroutput>
206 client request to mark out-of-date code, saving you from using
207 <option>--smc-check=all</option>.</para>
209 <para>Apart from this, in theory Valgrind can run any Java program
210 just fine, even those that use JNI and are partially implemented in
211 other languages like C and C++. In practice, Java implementations
212 tend to do nasty things that most programs do not, and Valgrind
213 sometimes falls over these corner cases.</para>
215 <para>If your Java programs do not run under Valgrind, even with
216 <option>--smc-check=all</option>, please file a bug report and
217 hopefully we'll be able to fix the problem.</para>
224 <!-- Valgrind behaves unexpectedly -->
225 <qandadiv id="faq.unexpected" xreflabel="Valgrind behaves unexpectedly">
226 <title>Valgrind behaves unexpectedly</title>
228 <qandaentry id="faq.reports">
229 <question id="q-reports">
230 <para>My program uses the C++ STL and string classes. Valgrind
231 reports 'still reachable' memory leaks involving these classes at
232 the exit of the program, but there should be none.</para>
234 <answer id="a-reports">
235 <para>First of all: relax, it's probably not a bug, but a feature.
236 Many implementations of the C++ standard libraries use their own
237 memory pool allocators. Memory for quite a number of destructed
238 objects is not immediately freed and given back to the OS, but kept
239 in the pool(s) for later re-use. The fact that the pools are not
240 freed at the exit of the program cause Valgrind to report this
241 memory as still reachable. The behaviour not to free pools at the
242 exit could be called a bug of the library though.</para>
244 <para>Using GCC, you can force the STL to use malloc and to free
245 memory as soon as possible by globally disabling memory caching.
246 Beware! Doing so will probably slow down your program, sometimes
250 <para>With GCC 2.91, 2.95, 3.0 and 3.1, compile all source using
251 the STL with <literal>-D__USE_MALLOC</literal>. Beware! This was
252 removed from GCC starting with version 3.3.</para>
255 <para>With GCC 3.2.2 and later, you should export the
256 environment variable <literal>GLIBCPP_FORCE_NEW</literal> before
257 running your program.</para>
260 <para>With GCC 3.4 and later, that variable has changed name to
261 <literal>GLIBCXX_FORCE_NEW</literal>.</para>
265 <para>There are other ways to disable memory pooling: using the
266 <literal>malloc_alloc</literal> template with your objects (not
267 portable, but should work for GCC) or even writing your own memory
268 allocators. But all this goes beyond the scope of this FAQ. Start
271 url="http://gcc.gnu.org/onlinedocs/libstdc++/faq/index.html#4_4_leak">
272 http://gcc.gnu.org/onlinedocs/libstdc++/faq/index.html#4_4_leak</ulink>
273 if you absolutely want to do that. But beware:
274 allocators belong to the more messy parts of the STL and
275 people went to great lengths to make the STL portable across
276 platforms. Chances are good that your solution will work on your
277 platform, but not on others.</para>
282 <qandaentry id="faq.unhelpful">
283 <question id="q-unhelpful">
284 <para>The stack traces given by Memcheck (or another tool) aren't
285 helpful. How can I improve them?</para>
287 <answer id="a-unhelpful">
288 <para>If they're not long enough, use <option>--num-callers</option>
289 to make them longer.</para>
291 <para>If they're not detailed enough, make sure you are compiling
292 with <option>-g</option> to add debug information. And don't strip
293 symbol tables (programs should be unstripped unless you run 'strip'
294 on them; some libraries ship stripped).</para>
296 <para>Also, for leak reports involving shared objects, if the shared object
297 is unloaded before the program terminates, Valgrind will discard the debug
298 information and the error message will be full of <literal>???</literal>
299 entries. If you use the option <option>--keep-debuginfo=yes</option>, then
300 Valgrind will keep the debug information in order to show the stack traces,
301 at the price of increased memory. An alternate workaround is to avoid
302 calling <function>dlclose</function> on these shared objects.</para>
304 <para>Also, <option>-fomit-frame-pointer</option> and
305 <option>-fstack-check</option> can make stack traces worse.</para>
307 <para>Some example sub-traces:</para>
311 <para>With debug information and unstripped (best):</para>
313 Invalid write of size 1
314 at 0x80483BF: really (malloc1.c:20)
315 by 0x8048370: main (malloc1.c:9)
320 <para>With no debug information, unstripped:</para>
322 Invalid write of size 1
323 at 0x80483BF: really (in /auto/homes/njn25/grind/head5/a.out)
324 by 0x8048370: main (in /auto/homes/njn25/grind/head5/a.out)
329 <para>With no debug information, stripped:</para>
331 Invalid write of size 1
332 at 0x80483BF: (within /auto/homes/njn25/grind/head5/a.out)
333 by 0x8048370: (within /auto/homes/njn25/grind/head5/a.out)
334 by 0x42015703: __libc_start_main (in /lib/tls/libc-2.3.2.so)
335 by 0x80482CC: (within /auto/homes/njn25/grind/head5/a.out)
340 <para>With debug information and -fomit-frame-pointer:</para>
342 Invalid write of size 1
343 at 0x80483C4: really (malloc1.c:20)
344 by 0x42015703: __libc_start_main (in /lib/tls/libc-2.3.2.so)
345 by 0x80482CC: ??? (start.S:81)
350 <para>A leak error message involving an unloaded shared object:</para>
352 84 bytes in 1 blocks are possibly lost in loss record 488 of 713
353 at 0x1B9036DA: operator new(unsigned) (vg_replace_malloc.c:132)
357 by 0x8049EE6: main (main.cpp:24)
365 <qandaentry id="faq.aliases">
366 <question id="q-aliases">
367 <para>The stack traces given by Memcheck (or another tool) seem to
368 have the wrong function name in them. What's happening?</para>
370 <answer id="a-aliases">
371 <para>Occasionally Valgrind stack traces get the wrong function
372 names. This is caused by glibc using aliases to effectively give
373 one function two names. Most of the time Valgrind chooses a
374 suitable name, but very occasionally it gets it wrong. Examples we know
375 of are printing <function>bcmp</function> instead of
376 <function>memcmp</function>, <function>index</function> instead of
377 <function>strchr</function>, and <function>rindex</function> instead of
378 <function>strrchr</function>.</para>
383 <qandaentry id="faq.crashes">
384 <question id="q-crashes">
385 <para>My program crashes normally, but doesn't under Valgrind, or vice
386 versa. What's happening?</para>
388 <answer id="a-crashes">
389 <para>When a program runs under Valgrind, its environment is slightly
390 different to when it runs natively. For example, the memory layout is
391 different, and the way that threads are scheduled is different.</para>
393 <para>Most of the time this doesn't make any difference, but it can,
394 particularly if your program is buggy. For example, if your program
395 crashes because it erroneously accesses memory that is unaddressable,
396 it's possible that this memory will not be unaddressable when run under
397 Valgrind. Alternatively, if your program has data races, these may not
398 manifest under Valgrind.</para>
400 <para>There isn't anything you can do to change this, it's just the
401 nature of the way Valgrind works that it cannot exactly replicate a
402 native execution environment. In the case where your program crashes
403 due to a memory error when run natively but not when run under Valgrind,
404 in most cases Memcheck should identify the bad memory operation.</para>.
410 <qandaentry id="faq.hiddenbug">
411 <question id="q-hiddenbug">
412 <para> Memcheck doesn't report any errors and I know my program has
415 <answer id="a-hiddenbug">
416 <para>There are two possible causes of this.</para>
418 <para>First, by default, Valgrind only traces the top-level process.
419 So if your program spawns children, they won't be traced by Valgrind
420 by default. Also, if your program is started by a shell script,
421 Perl script, or something similar, Valgrind will trace the shell, or
422 the Perl interpreter, or equivalent.</para>
424 <para>To trace child processes, use the
425 <option>--trace-children=yes</option> option.</para>
427 <para>If you are tracing large trees of processes, it can be less
428 disruptive to have the output sent over the network. Give Valgrind
429 the option <option>--log-socket=127.0.0.1:12345</option> (if you want
430 logging output sent to port <literal>12345</literal> on
431 <literal>localhost</literal>). You can use the valgrind-listener
432 program to listen on that port:</para>
434 valgrind-listener 12345
437 <para>Obviously you have to start the listener process first. See
438 the manual for more details.</para>
440 <para>Second, if your program is statically linked, most Valgrind
441 tools will only work well if they are able to replace certain
442 functions, such as <function>malloc</function>, with their own
443 versions. By default, statically linked <function>malloc
444 functions</function> are not replaced. A key indicator of this is
447 All heap blocks were freed -- no leaks are possible
449 when you know your program calls <function>malloc</function>. The
450 workaround is to use the option
451 <option>--soname-synonyms=somalloc=NONE</option>
452 or to avoid statically linking your program.</para>
454 <para>There will also be no replacement if you use an alternative
455 <function>malloc library</function> such as tcmalloc, jemalloc,
456 ... In such a case, the
457 option <option>--soname-synonyms=somalloc=zzzz</option> (where
458 zzzz is the soname of the alternative malloc library) will allow
459 Valgrind to replace the functions.</para>
464 <qandaentry id="faq.overruns">
465 <question id="q-overruns">
466 <para>Why doesn't Memcheck find the array overruns in this
482 <answer id="a-overruns">
483 <para>Unfortunately, Memcheck doesn't do bounds checking on global
484 or stack arrays. We'd like to, but it's just not possible to do in
485 a reasonable way that fits with how Memcheck works. Sorry.</para>
487 <para>However, the experimental tool SGcheck can detect errors like
488 this. Run Valgrind with the <option>--tool=exp-sgcheck</option> option
489 to try it, but be aware that it is not as robust as Memcheck.</para>
497 <!-- Miscellaneous -->
498 <qandadiv id="faq.misc" xreflabel="Miscellaneous">
499 <title>Miscellaneous</title>
501 <qandaentry id="faq.writesupp">
502 <question id="q-writesupp">
503 <para>I tried writing a suppression but it didn't work. Can you
504 write my suppression for me?</para>
506 <answer id="a-writesupp">
507 <para>Yes! Use the <option>--gen-suppressions=yes</option> feature
508 to spit out suppressions automatically for you. You can then edit
509 them if you like, eg. combining similar automatically generated
510 suppressions using wildcards like <literal>'*'</literal>.</para>
512 <para>If you really want to write suppressions by hand, read the
513 manual carefully. Note particularly that C++ function names must be
514 mangled (that is, not demangled).</para>
519 <qandaentry id="faq.deflost">
520 <question id="q-deflost">
521 <para>With Memcheck's memory leak detector, what's the
522 difference between "definitely lost", "indirectly lost", "possibly
523 lost", "still reachable", and "suppressed"?</para>
525 <answer id="a-deflost">
526 <para>The details are in the Memcheck section of the user manual.</para>
528 <para>In short:</para>
531 <para>"definitely lost" means your program is leaking memory --
532 fix those leaks!</para>
535 <para>"indirectly lost" means your program is leaking memory in
536 a pointer-based structure. (E.g. if the root node of a binary tree
537 is "definitely lost", all the children will be "indirectly lost".)
538 If you fix the "definitely lost" leaks, the "indirectly lost" leaks
543 <para>"possibly lost" means your program is leaking
544 memory, unless you're doing unusual things with pointers that could
545 cause them to point into the middle of an allocated block; see the
546 user manual for some possible causes. Use
547 <option>--show-possibly-lost=no</option> if you don't want to see
548 these reports.</para>
551 <para>"still reachable" means your program is probably ok -- it
552 didn't free some memory it could have. This is quite common and
553 often reasonable. Don't use
554 <option>--show-reachable=yes</option> if you don't want to see
555 these reports.</para>
558 <para>"suppressed" means that a leak error has been suppressed.
559 There are some suppressions in the default suppression files.
560 You can ignore suppressed errors.</para>
566 <qandaentry id="faq.undeferrors">
567 <question id="q-undeferrors">
568 <para>Memcheck's uninitialised value errors are hard to track down,
569 because they are often reported some time after they are caused. Could
570 Memcheck record a trail of operations to better link the cause to the
571 effect? Or maybe just eagerly report any copies of uninitialised
572 memory values?</para>
574 <answer id="a-undeferrors">
575 <para>Prior to version 3.4.0, the answer was "we don't know how to do it
576 without huge performance penalties". As of 3.4.0, try using the
577 <option>--track-origins=yes</option> option. It will run slower than
578 usual, but will give you extra information about the origin of
579 uninitialised values.</para>
581 <para>Or if you want to do it the old fashioned way, you can use the
583 <computeroutput>VALGRIND_CHECK_VALUE_IS_DEFINED</computeroutput> to help
584 track these errors down -- work backwards from the point where the
585 uninitialised error occurs, checking suspect values until you find the
586 cause. This requires editing, compiling and re-running your program
587 multiple times, which is a pain, but still easier than debugging the
588 problem without Memcheck's help.</para>
590 <para>As for eager reporting of copies of uninitialised memory values,
591 this has been suggested multiple times. Unfortunately, almost all
592 programs legitimately copy uninitialised memory values around (because
593 compilers pad structs to preserve alignment) and eager checking leads to
594 hundreds of false positives. Therefore Memcheck does not support eager
595 checking at this time.</para>
600 <qandaentry id="faq.attach">
601 <question id="q-attach">
602 <para>Is it possible to attach Valgrind to a program that is already
605 <answer id="a-attach">
606 <para>No. The environment that Valgrind provides for running programs
607 is significantly different to that for normal programs, e.g. due to
608 different layout of memory. Therefore Valgrind has to have full control
609 from the very start.</para>
611 <para>It is possible to achieve something like this by running your
612 program without any instrumentation (which involves a slow-down of about
613 5x, less than that of most tools), and then adding instrumentation once
614 you get to a point of interest. Support for this must be provided by
615 the tool, however, and Callgrind is the only tool that currently has
616 such support. See the instructions on the
617 <computeroutput>callgrind_control</computeroutput> program for details.
627 <!-- Further Assistance -->
628 <qandadiv id="faq.help" xreflabel="How To Get Further Assistance">
629 <title>How To Get Further Assistance</title>
631 <!-- WARNING: this file should not xref other parts of the docs, because it
632 is built standalone as FAQ.txt. That's why we link to, for example, the
633 online copy of the manual. -->
635 <qandaentry id="e-help">
636 <!-- <question><para/></question> -->
638 <para>Read the appropriate section(s) of the
639 <ulink url="&vg-docs-url;">Valgrind Documentation</ulink>.</para>
641 <para><ulink url="http://search.gmane.org">Search</ulink> the
642 <ulink url="http://news.gmane.org/gmane.comp.debugging.valgrind">valgrind-users</ulink> mailing list archives, using the group name
643 <computeroutput>gmane.comp.debugging.valgrind</computeroutput>.</para>
645 <para>If you think an answer in this FAQ is incomplete or inaccurate, please
646 e-mail <ulink url="mailto:&vg-vemail;">&vg-vemail;</ulink>.</para>
648 <para>If you have tried all of these things and are still
649 stuck, you can try mailing the
650 <ulink url="&vg-lists-url;">valgrind-users mailing list</ulink>.
651 Note that an email has a better change of being answered usefully if it is
652 clearly written. Also remember that, despite the fact that most of the
653 community are very helpful and responsive to emailed questions, you are
654 probably requesting help from unpaid volunteers, so you have no guarantee
655 of receiving an answer.</para>
662 <!-- FAQ ends here -->
668 <qandadiv id="faq.installing" xreflabel="Installing">
669 <title>Installing</title>
671 <qandaentry id="faq.problem">
672 <question id="q-problem">
675 <answer id="a-problem">