Why is this function indirectly changing a uint variable?

Question

I'm having an issue with a smart contract I've created where variables are being affected by a function that does not access them. I am using Remix to test this.

//Solidity Version
pragma solidity ^0.4.0;

//Contract Code
contract TicTacToe{

//Struct for cell
struct Cell {
    uint row;
    uint column;
    address played;
}

//Struct for game board
struct GameBoard {
    bool gameWon;
    address _player1;
    address _player2;
    Cell[] board;
}
//These variables are being affected due to newGame();
uint private numberOfGames = 0; //I set this to private and created a getter (getGameNum()), but same occurs if public.
GameBoard[] public _games; //This is also being affected - newGame() will fill the array, even though only one item is being pushed.

//Publig getter for numberOfGames uint.
function getGameNum() public returns(uint){
    return numberOfGames;
}

//Function that creates an array. This will eventually add it to _games but until issue is resolved, I'm leaving it.
function newGame() public {
    //Create a temporary board (to be pushed later)
    GameBoard tempBoard;
    //Fill attributes of board
    tempBoard._player1 = msg.sender;
    tempBoard._player2 = msg.sender;
    tempBoard.gameWon = false;

    uint counter = 0;
    //For each row
    for (uint row = 1; row <= 3; row++) {
        //For each column
        for (uint column = 1; column <= 3; column++) {
            tempBoard.board.length++;
            tempBoard.board[counter].row = row;
            tempBoard.board[counter].column = column;
            tempBoard.board[counter].played = 0x0;
            counter++;
        }
    }
}
}

"numberOfGames" is correctly set to 0 on contract creating (you can verify this using getGameNum() ). However, when newGame() is called, the value is changed to 295530007198671819985454669347690311693110848207872. Likewise, the _games array is filled when the newGame() function is called, even when the function doesn't interact with that array.

Any reason why this would be happening?

Answer 1

This line should give you a warning from the Solidity compiler:

GameBoard tempBoard;

The warning tells you that this implicitly uses a storage variable and encourages you to explicitly label this as such:

GameBoard storage tempBoard;

The next warning tells you that this is an uninitialized storage reference. That means it points to slot 0 in storage. Writing to it will overwrite the storage values at slot 0, etc.

E.g.

tempBoard._player1 = msg.sender;
tempBoard._player2 = msg.sender;

is just like doing:

numberOfGames = uint256(msg.sender);
_games.length = uint256(msg.sender);

This is why numberOfGames is modified and the _games array suddenly has a non-zero length.

In short, don't do this. You want to use a memory variable:

GameBoard memory tempBoard;

EDIT

Sorry, missed the bool at the beginning of the struct. So my "is just like doing" lines of code are actually slightly incorrect. But the bool and address should both be packed into the same storage slot, overwriting numberOfGames, so I believe you'll still see msg.sender in that variable (because the bool is false, so just 0).