# Expandarray may mark dirty VALUE beyond stack

**URL:** <https://www.ruby-forum.com/t/expandarray-may-mark-dirty-value-beyond-stack/123007>\
**Category:** Development\
**Created:** [December 13, 2007, 11:38am UTC](https://www.ruby-forum.com/t/expandarray-may-mark-dirty-value-beyond-stack/123007 "2007-12-13T11:38:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yusuke\_ENDOH](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/c89c15/32.png) [@Yusuke\_ENDOH](https://www.ruby-forum.com/u/Yusuke_ENDOH)\
**Post date:** [December 13, 2007, 11:38am UTC](https://www.ruby-forum.com/t/expandarray-may-mark-dirty-value-beyond-stack/123007/1 "2007-12-13T11:38:26Z")

</div>

e$B1sF#$H?=$7$^$9!#e(B

aaa, aab, aac, …(300 e$B8D$/$i$$e(B)…, \*zzz = 1  
e$B$H$$$&B?=EBeF~$re(B  
GC.stress=true e$B$+$De(B Fiber e$B$NCf$G\<B9T$9$k$HMn$A$^$9!#e(B

$ ./ruby -e ’  
a,s=[],“aaa”  
300.times { a\<\<s; s=s.succ }  
puts \<\<END  
GC.stress=true  
Fiber.new do  
#{ a.join(",") },\*zzz=1  
end.resume  
END  
’ \> t.rb

## $ ./ruby t.rb t.rb:3: – control frame ---------- c:0003 p:0006 s:0607 b:0305 l:00110c d:000304 BLOCK t.rb:3 c:0002 p:---- s:0003 b:0003 l:000002 d:000002 FINISH :(null) c:0001 p:---- s:0001 b:-001 l:000000 d:000000 ------ :(null)

## – backtrace of native function call (Use addr2line) – 0x80ebbf5 0x8109e93 0x8109f5b 0x80bcdd0 0xffffe440 0x8062c4f 0x806386b 0x80634c1 0x80634c1 0x80634c1 (snip) 0x80634c1 0x80634c1 0x80e19bd 0x8063538 0x80e18b1 0x80c13f0 0x80e1ca0 0x8063538 0x8063d33 0x8064545 0x80f3a2c 0x80f3d8a 0x80f5194 0x80f573c 0x80e6026 0x80ea4b4 0x80e3707 0x80e3e37 0x80f1148 0x805a6e3 0x805e510 0x8058220 0xb7d6dea8 0x8058141

[BUG] Segmentation fault  
ruby 1.9.0 (2007-12-13) [i686-linux]

e$B%"%!\<%H$7$^$7$?e(B

e$B860x$O!"e(Bvm\_expandarray e$BFb$Ge(B rb\_ary\_to\_ary  
e$B$r\<B9T$9$kA0$Ke(B sp e$B$re(B  
e$B$:$i$7$F$$$k$?$a!"e(Brb\_ary\_to\_ary e$BFb$Ge(B GC  
e$B$,H/@8$7$?$H$-!"L58z$Je(B  
VALUE e$BCM$re(B mark e$B$7$F$7$^$C$F$$$k$N$@$H;W$$$^$9!#e(B

# Index: insnhelper.ci

— insnhelper.ci (revision 14213)  
+++ insnhelper.ci (working copy)  
@@ -1347,12 +1347,12 @@  
volatile VALUE tmp\_ary;  
int len;

- cfp-\>sp += space\_size;
- if (TYPE(ary) != T\_ARRAY) {  
ary = rb\_ary\_to\_ary(ary);  
}

- cfp-\>sp += space\_size;
- tmp\_ary = ary;  
ptr = RARRAY\_PTR(ary);  
len = RARRAY\_LEN(ary);