# \[Bug #3463\] 1.9.2-preview3 $B$G(B \[BUG\] gc\_sweep(): unknown data type 0x0

**URL:** <https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542>\
**Category:** Development\
**Created:** [June 22, 2010, 12:50pm UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542 "2010-06-22T12:50:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tomoyuki\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c0e974/32.png) [@Tomoyuki\_C](https://www.ruby-forum.com/u/Tomoyuki_C)\
**Post date:** [June 22, 2010, 12:50pm UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542/1 "2010-06-22T12:50:35Z")

</div>

e$B%A%1%C%He(B #3463 e$B$,99?7$5$l$^$7$?!#e(B (by Tomoyuki C.)

e$B%U%!%$%ke(B marshal.patch e$BDI2Ce(B

e$B$9$\_$^$;$s!“@hDxE:IU$7$?%Q%C%A$OLdBj$,$”$j$^$7$?!#e(B  
struct dump\_arg::str  
e$B$,;X$9%9%m%C%H$,0lC62s\<}$5$l$FB\>$N%_%V%8%'%/%H$K3d$jEv$F$i$l$F$$$?;~$K4V0c$C$Fe(B  
taint e$B$7$F$7$^$$$=$&$G$9!#e(B  
T\_DATA e$B7?$N%_%V%8%'%/%H$KEPO?$9$ke(B free e$B4X?t$NCf$G$O9=B$BN$,e(B  
VALUE  
e$B7?$G;}$C$F$$$ke(BRubye$B$N;2\>H$O0l@Z$5$o$C$F$O$$$1$J$$$G$9$M!#e(B

struct dump\_arg e$B$Ne(B str e$B$Oe(B w\_nbytes e$B$G=q$-9~$`;~$Ke(B  
OBJ\_TAINT/OBJ\_UNTRUST  
e$B$9$l$PNI$$$N$G$O$J$$$+$H9M$(%Q%C%A$r=q$-D\>$7$^$7$?!#e(B  
make test-all  
e$B$G%(%i!\<$,A}$($J$$$3$H$H!"0l1~0J2\<$N$h$&$J4JC1$J3NG’$r$7$^$7$?!#e(B

> > obj = Object.new  
> > =\> #Object:0x8d3680c  
> > Marshal.dump(obj).tainted?  
> > =\> false  
> > obj.taint  
> > =\> #Object:0x8d3680c  
> > Marshal.dump(obj).tainted?  
> > =\> true

* * *

[http://redmine.ruby-lang.org/issues/show/3463](http://redmine.ruby-lang.org/issues/show/3463)

---

<div class="post-metadata">

**Author:** ![Tomoyuki\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c0e974/32.png) [@Tomoyuki\_C](https://www.ruby-forum.com/u/Tomoyuki_C)\
**Post date:** [June 22, 2010, 2:03pm UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542/2 "2010-06-22T14:03:09Z")

</div>

e$B$J$+$@$G$9!#e(B

At Tue, 22 Jun 2010 19:49:59 +0900,  
Tomoyuki C. wrote in [ruby-dev:41672]:

> e$B$9$\_$^$;$s!"@hDxE:IU$7$?%Q%C%A$OLdBj$,$"$j$^$7$?!#e(B  
> struct dump\_arg::str e$B$,;X$9%9%m%C%H$,0lC62s\<}$5$l$FB\>$N%_%V%8%'e(B  
> e$B%/%H$K3d$jEv$F$i$l$F$$$?;~$K4V0c$C$Fe(B taint e$B$7$F$7$^$$$=$&$G$9!#e(B  
> T\_DATA e$B7?$N%_%V%8%’%/%H$KEPO?$9$ke(B free e$B4X?t$NCf$G$O9=B$BN$,e(B  
> VALUE e$B7?$G;}$C$F$$$ke(BRubye$B$N;2\>H$O0l@Z$5$o$C$F$O$$$1$J$$$G$9$M!#e(B

finaliser\_at\_exite$B$N;~E@$G$O!"?7$7$$%\*%V%8%’%/%H$,3d$jEv$F$i$l$ke(B  
e$B$3$H$O9M$($J$/$F$b$$$$$s$8$c$J$$$+$H;W$$$^$9$,!#e(B

> struct dump\_arg e$B$Ne(B str e$B$Oe(B w\_nbytes e$B$G=q$-9~$`;~$Ke(B  
> OBJ\_TAINT/OBJ\_UNTRUST e$B$9$l$PNI$$$N$G$O$J$$$+$H9M$(%Q%C%A$r=q$-e(B  
> e$BD\>$7$^$7$?!#e(B  
> make test-all e$B$G%(%i!\<$,A}$($J$$$3$H$H!"0l1~0J2\<$N$h$&$J4JC1$Je(B  
> e$B3NG’$r$7$^$7$?!#e(B

e$B$h$5$=$&$K8+$($^$9!#F~$l$A$c$C$F$$$$$s$8$c$J$$$G$9$+$M!#e(B

---

<div class="post-metadata">

**Author:** ![Tomoyuki\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c0e974/32.png) [@Tomoyuki\_C](https://www.ruby-forum.com/u/Tomoyuki_C)\
**Post date:** [June 23, 2010, 2:27am UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542/3 "2010-06-23T02:27:53Z")

</div>

e$B6a1J$H?=$7$^$9!#e(B

e$B%Q%C%A$N%l%S%e!\<$"$j$,$H$&$4$6$$$^$9!#e(B

(2010/06/22 21:02), Nobuyoshi N. wrote:  
(snip)

> finaliser\_at\_exite$B$N;~E@$G$O!"?7$7$$%\*%V%8%’%/%H$,3d$jEv$F$i$l$ke(B  
> e$B$3$H$O9M$($J$/$F$b$$$$$s$8$c$J$$$+$H;W$$$^$9$,!#e(B  
> clear\_dump\_arg e$B$Ke(B arg-\>str e$B$Ne(B flags e$B$,e(B 0  
> e$B$GMh$F$?;~$O!"2\<$N$h$&$Je(B  
> e$B%3!\<%k%9%?%C%/$G$7$?!#IaDL$K%a%=%C%I8F$S=P$7$N4V$KCY1d$5$l$?e(B  
> free e$B4X?t$N8F$S=P$7$,64$\_9~$^$l$F$$$k$h$&$G$9!#e(B

e$B$H$3$m$G!"C1$K6=L#$+$i?V$$$F$_$?$$$N$G$9$,!"$J$\<$3$N$h$&$Ke(B  
T\_DATAe$B7?%\*%V%8%’%/%H$N2rJ|$OCY1d$5$l$F$k$s$G$7$g$&!#e(B  
GC e$B$G$NDd;_;~4V$rJ,;6$5$;$k$?$a$G$7$g$&$+!)e(B

#0 clear\_dump\_arg (arg=0xa9f63c0) at marshal.c:856  
#1 0x0807cec2 in free\_dump\_arg (ptr=0xa9f63c0) at marshal.c:175  
#2 0x080641ad in run\_final (objspace=0x9829808, obj=167215020) at  
gc.c:2601  
#3 0x08062a17 in finalize\_list (objspace=0x9829808, p=0x9f77fac) at  
gc.c:1806  
#4 0x0806422a in finalize\_deferred (objspace=0x9829808) at gc.c:2617  
#5 0x0806423d in gc\_finalize\_deferred (objspace=0x9829808) at gc.c:2624  
#6 0x08064263 in rb\_gc\_finalize\_deferred () at gc.c:2631  
#7 0x0814922c in rb\_threadptr\_execute\_interrupts\_rec (th=0xb5023148,  
sched\_depth=0) at thread.c:1295  
#8 0x08149312 in rb\_threadptr\_execute\_interrupts (th=0xb5023148)  
at thread.c:1323  
#9 0x081354e3 in vm\_call\_method (th=0xb5023148, cfp=0xb6bfe980, num=0,  
blockptr=0x0, flag=0, id=784, me=0x9869b60, recv=7538958)  
at vm\_insnhelper.c:669  
#10 0x081394c3 in vm\_exec\_core (th=0xb5023148, initial=0) at  
insns.def:999  
#11 0x0814418d in vm\_exec (th=0xb5023148) at vm.c:1139

Chikanaga Tomoyuki  
Nippon Control System Corp.

---

<div class="post-metadata">

**Author:** ![Tomoyuki\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c0e974/32.png) [@Tomoyuki\_C](https://www.ruby-forum.com/u/Tomoyuki_C)\
**Post date:** [June 23, 2010, 9:23am UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542/4 "2010-06-23T09:23:27Z")

</div>

e$B$J$+$@$G$9!#e(B

At Wed, 23 Jun 2010 09:27:11 +0900,  
Tomoyuki C. wrote in [ruby-dev:41677]:

> > finaliser\_at\_exite$B$N;~E@$G$O!"?7$7$$%\*%V%8%’%/%H$,3d$jEv$F$i$l$ke(B  
> > e$B$3$H$O9M$($J$/$F$b$$$$$s$8$c$J$$$+$H;W$$$^$9$,!#e(B  
> > clear\_dump\_arg e$B$Ke(B arg-\>str e$B$Ne(B flags e$B$,e(B 0 e$B$GMh$F$?;~$O!"2\<$N$h$&$Je(B  
> > e$B%3!\<%k%9%?%C%/$G$7$?!#IaDL$K%a%=%C%I8F$S=P$7$N4V$KCY1d$5$l$?e(B  
> > free e$B4X?t$N8F$S=P$7$,64$\_9~$^$l$F$$$k$h$&$G$9!#e(B

e$B$&$C$+$j$7$F$^$7$?!#e(B

> e$B$H$3$m$G!"C1$K6=L#$+$i?V$$$F$_$?$$$N$G$9$,!"$J$\<$3$N$h$&$Ke(B  
> T\_DATAe$B7?%\*%V%8%’%/%H$N2rJ|$OCY1d$5$l$F$k$s$G$7$g$&!#e(B  
> GC e$B$G$NDd;_;~4V$rJ,;6$5$;$k$?$a$G$7$g$&$+!)e(B

dfreee$B4X?t$N8F$S=P$7Cf$K%\*%V%8%’%/%H$N3d$jEv$F$r$9$k3HD%%i%$%V%ie(B  
e$B%j$,$"$C$?$N$G!"e(Bmark phasee$B$HJ,N%$7$?$s$G$7$?!#e(B

e$B$D$$$G$K!"e(BTAINTEDe$B$He(BUNTRUSTEDe$B$r$R$H$^$H$a$K07$&$h$&$K$7$F$\_$^$7$?!#e(B  
e$B$3$l$G$I$&$G$7$g$&!#e(B

diff --git a/marshal.c b/marshal.c  
index fa91afa…3263a57 100644  
— a/marshal.c  
+++ b/marshal.c  
@@ -131,14 +131,16 @@ rb\_marshal\_define\_compat(VALUE newclass, VALUE  
oldclass, VALUE (\*dumper)(VALUE),  
st\_insert(compat\_allocator\_tbl, (st\_data\_t)allocator,  
(st\_data\_t)compat);  
}

+#define MARSHAL\_INFECTION (FL\_TAINT|FL\_UNTRUSTED)  
+typedef char ruby\_check\_marshal\_viral\_flags[MARSHAL\_INFECTION ==  
(int)MARSHAL\_INFECTION ? 1 : -1];  
+  
struct dump\_arg {  
VALUE str, dest;  
st\_table \*symbols;  
st\_table \*data;

- int taint;
- int untrust;  
st\_table \*compat\_tbl;  
st\_table \*encodings;

- int infection;  
};

struct dump\_call\_arg {  
@@ -224,9 +226,8 @@ w\_nbyte(const char \*s, long n, struct dump\_arg \*arg)  
{  
VALUE buf = arg-\>str;  
rb\_str\_buf\_cat(buf, s, n);

- RBASIC(buf)-\>flags |= arg-\>infection;  
if (arg-\>dest && RSTRING\_LEN(buf) \>= BUFSIZ) {

- if (arg-\>taint) OBJ\_TAINT(buf);
- if (arg-\>untrust) OBJ\_UNTRUST(buf);  
rb\_io\_write(arg-\>dest, buf);  
rb\_str\_resize(buf, 0);  
}  
@@ -636,8 +637,7 @@ w\_object(VALUE obj, struct dump\_arg \*arg, int limit)  
w\_symbol(SYM2ID(obj), arg);  
}  
else {
- if (OBJ\_TAINTED(obj)) arg-\>taint = TRUE;
- if (OBJ\_UNTRUSTED(obj)) arg-\>untrust = TRUE;

- arg-\>infection |= FL\_TEST(obj, MARSHAL\_INFECTION);

- if (arg-\>taint) {
- OBJ\_TAINT(arg-\>str);
- }
- if (arg-\>untrust) {
- OBJ\_UNTRUST(arg-\>str);
- }  
}

/\*  
@@ -922,8 +916,7 @@ marshal\_dump(int argc, VALUE \*argv)  
arg-\>dest = 0;  
arg-\>symbols = st\_init\_numtable();  
arg-\>data = st\_init\_numtable();

- arg-\>taint = FALSE;
- arg-\>untrust = FALSE;

- arg-\>infection = 0;  
arg-\>compat\_tbl = st\_init\_numtable();  
arg-\>encodings = 0;  
arg-\>str = rb\_str\_buf\_new(0);  
@@ -962,9 +955,8 @@ struct load\_arg {  
st\_table \*symbols;  
st\_table \*data;  
VALUE proc;

- int taint;
- int untrust;  
st\_table \*compat\_tbl;

- int infection;  
};

static void  
@@ -1118,8 +1110,7 @@ r\_bytes0(long len, struct load\_arg \*arg)  
if (NIL\_P(str)) goto too\_short;  
StringValue(str);  
if (RSTRING\_LEN(str) != len) goto too\_short;

- if (OBJ\_TAINTED(str)) arg-\>taint = TRUE;
- if (OBJ\_UNTRUSTED(str)) arg-\>untrust = TRUE;

- arg-\>infection |= FL\_TEST(str, MARSHAL\_INFECTION);  
}  
return str;  
}  
@@ -1220,15 +1211,10 @@ r\_entry0(VALUE v, st\_index\_t num, struct  
load\_arg \*arg)  
else {  
st\_insert(arg-\>data, num, (st\_data\_t)v);  
}

- if (arg-\>taint) {
- 

```
   OBJ_TAINT(v);

```

- 

```
   if ((VALUE)real_obj != Qundef)

```

- 

```
       OBJ_TAINT((VALUE)real_obj);

```

- }
- if (arg-\>untrust) {
- 

```
   OBJ_UNTRUST(v);

```

- 

```
   if ((VALUE)real_obj != Qundef)

```

- 

```
       OBJ_UNTRUST((VALUE)real_obj);

```

- if (arg-\>infection) {
- FL\_SET(v, arg-\>infection);
- if ((VALUE)real\_obj != Qundef)
- 

```
 FL_SET((VALUE)real_obj, arg->infection);

```

}  
return v;  
}  
@@ -1765,7 +1751,7 @@ static VALUE  
marshal\_load(int argc, VALUE \*argv)  
{  
VALUE port, proc;

- int major, minor, taint = FALSE;

- int major, minor, infection = 0;  
VALUE v;  
volatile VALUE wrapper;  
struct load\_arg \*arg;  
@@ -1773,21 +1759,20 @@ marshal\_load(int argc, VALUE \*argv)  
rb\_scan\_args(argc, argv, “11”, &port, &proc);  
v = rb\_check\_string\_type(port);  
if (!NIL\_P(v)) {

- taint = OBJ\_TAINTED(port); /\* original taintedness \*/

- infection = FL\_TEST(port, MARSHAL\_INFECTION); /\* original taintedness  
\*/  
port = v;  
}  
else if (rb\_respond\_to(port, s\_getbyte) && rb\_respond\_to(port,  
s\_read)) {  
if (rb\_respond\_to(port, s\_binmode)) {  
rb\_funcall2(port, s\_binmode, 0, 0);  
}

- taint = TRUE;

- infection = FL\_TAINT | FL\_TEST(port, FL\_UNTRUSTED);;  
}  
else {  
rb\_raise(rb\_eTypeError, “instance of IO needed”);  
}  
wrapper = TypedData\_Make\_Struct(rb\_cData, struct load\_arg,  
&load\_arg\_data, arg);

- arg-\>taint = taint;
- arg-\>untrust = OBJ\_UNTRUSTED(port);

- arg-\>infection = infection;  
arg-\>src = port;  
arg-\>offset = 0;  
arg-\>symbols = st\_init\_numtable();

---

<div class="post-metadata">

**Author:** ![Tomoyuki\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c0e974/32.png) [@Tomoyuki\_C](https://www.ruby-forum.com/u/Tomoyuki_C)\
**Post date:** [June 23, 2010, 11:21am UTC](https://www.ruby-forum.com/t/bug-3463-1-9-2-preview3-b-g-b-bug-gc-sweep-unknown-data-type-0x0/190542/5 "2010-06-23T11:21:06Z")

</div>

e$B6a1J$H?=$7$^$9!#e(B

> dfreee$B4X?t$N8F$S=P$7Cf$K%_%V%8%’%/%H$N3d$jEv$F$r$9$k3HD%%i%$%V%ie(B  
> e$B%j$,$"$C$?$N$G!“e(Bmark phasee$B$HJ,N%$7$?$s$G$7$?!#e(B  
> e$B$J$k$[$I!”$=$&$$$&M}M3$G$7$?$+!#e(B  
> README.EXT(.ja) e$B$K$Oe(B mark/free e$B4X?t$+$ie(B Ruby  
> e$B$N%_%V%8%’%/%H$re(B  
> e$B3NJ]$7$A$c$@$a$H5-:$5$l$F$^$9$,!"$=$N@)8B$O\<h$j$O$i$o$l$F$$$k$s$G$9$M!#e(B

> e$B$D$$$G$K!“e(BTAINTEDe$B$He(BUNTRUSTEDe$B$r$R$H$^$H$a$K07$&$h$&$K$7$F$\_$^$7$?!#e(B  
> e$B$3$l$G$I$&$G$7$g$&!#e(B  
> e$B$”$j$,$H$&$4$6$$$^$9!#e(B  
> e$BG0$N$?$a\<j85$G$3$A$i$N%Q%C%A$r$"$F$?$b$N$be(B gc\_sweep(): unknown  
> data type e$B$,e(B  
> e$BH/@8$7$J$$$3$H$r3NG’CW$7$^$7$?!#e(B

Chikanaga Tomoyuki  
Nippon Control System Corp.