# Uninitialized _tag.retval value is used

e\$B5\$\$,\$D\$\$\$?\$N\$G\$9\$,!"e(B_tag.retval e\$B\$r=i4|2=\$7\$J\$\$\$G;H\$&\$3\$H\$,\$"e(B
e\$B\$k\$h\$&\$G\$9!#e(B

e\$B0J2<\$N\$h\$&\$Ke(B TH_PUSH_TAG(th); e\$B\$ND>8e\$G!"\$^[email protected](B _tag
e\$B\$,=i4|2=\$5e(B
e\$B\$l\$F\$\$i\$:!"\$I\$s\$JCM\$G\$b\$\$+\$7\$/\$J\$\$>uBV\$G!"e(B123456 e\$B\$H\$\$\$&CMe(B
e\$B\$rBeF~\$7\$^\$9!#e(B

e\$B\$=\$7\$F!"e(Bvm_make_jump_tag_but_local_jump e\$B\$Ge(B retval
e\$B\$r;H\$&\$H\$-e(B
e\$B\$Ke(B 123456 e\$B\$H\$\$\$&\$K\$J\$k\$I\$&\$+\$rD4\$Y\$k\$h\$&\$K\$7\$^\$9!#e(B

# Index: vm.c

— vm.c (revision 16271)
+++ vm.c (working copy)
@@ -912,7 +912,11 @@ vm_make_jump_tag_but_local_jump(int stat
VALUE result = Qnil;

`````` if (val == Qundef)
``````
• {

• ``````   if(val == 123456)
``````
• ``````       fprintf(stderr, "retval is 123456\n");
``````
• }
switch (state) {
case 0:
break;
@@ -1142,6 +1146,7 @@ vm_eval_body(rb_thread_t *th)
VALUE initial = 0;

TH_PUSH_TAG(th);

• _tag.retval = 123456;
if ((state = EXEC_TAG()) == 0) {
vm_loop_start:
result = vm_eval(th, initial);

e\$B\$=\$7\$F!"0J2<\$Ne(B s1.rb, s2.rb, s3.rb e\$B\$rMQ0U\$7\$^\$9!#e(B

% cat s1.rb
def m
proc {
}.call
ensure
GC.start
end
m

% cat s2.rb
require ‘s3.rb’
X.call

% cat s3.rb
X = proc do
lambda {
return
}.call
end

e\$B\$=\$7\$F!">e5-\$NJQ99\$r9T\$C\$?e(B ruby e\$B\$Ge(B s1.rb
e\$B\$r<B9T\$9\$k\$H!“e(B
retval e\$B\$,e(B 123456 e\$B\$K\$J\$k\$3\$H\$,8!=P\$5\$l!”\$=\$N8e\$Ge(B SEGV
e\$B\$7\$^\$9!#e(B

% ./ruby s1.rb
retval is 123456
s1.rb:6: [BUG] Segmentation fault
ruby 1.9.0 (2008-05-02 revision 16271) [i686-linux]

## DBG> : “s1.rb:6:in `ensure in m'" DBG> : "s1.rb:6:in`m’” DBG> : “s1.rb:8:in `’” – backtrace of native function call (Use addr2line) – 0x8100595 0x8126ade 0x8126b3b 0x80cd770 0xb7fea440 0x8064f01 0x80f5d9d 0x8064aab 0x80f5c91 0x80d2200 0x80f6080 0x8064aab 0x8065425 0x8065d60 0x8065d7b 0x80fed93 0x80fa715 0x80fdf84 0x80fe2bd 0x805afbf 0x805e67e 0x8058ab5 0xb7e4bea8 0x80589b1

zsh: abort (core dumped) ./ruby s1.rb
% gdb ruby core.3723
GNU gdb 6.4.90-debian
GDB is free software, covered by the GNU General Public
welcome to change it and/or distribute copies of it under
certain conditions.
Type “show copying” to see the conditions.
There is absolutely no warranty for GDB. Type “show
warranty” for details.
This GDB was configured as “i486-linux-gnu”…Using host

error.
/lib/tls/i686/cmov/libcrypt.so.1…done.
from /usr/lib/debug/lib/ld-2.3.6.so…done.
done.
/tmp/b/lib/ruby/1.9.0/i686-linux/enc/encdb.so…done.
/tmp/b/lib/ruby/1.9.0/i686-linux/enc/encdb.so
/tmp/b/lib/ruby/1.9.0/i686-linux/enc/trans/transdb.so…done.
/tmp/b/lib/ruby/1.9.0/i686-linux/enc/trans/transdb.so
Core was generated by `./ruby s1.rb’.
Program terminated with signal 6, Aborted.
#0 0xb7fea410 in ?? ()
(gdb) bt
#0 0xb7fea410 in ?? ()
#1 0xbfffdb9c in ?? ()
#2 0x00000006 in ?? ()
#3 0x00000e8b in ?? ()
#4 0xb7e5f811 in raise () from /lib/tls/i686/cmov/libc.so.6
#5 0xb7e60fb9 in abort () from /lib/tls/i686/cmov/libc.so.6
#6 0x08126b40 in rb_bug (fmt=0x815404d “Segmentation
fault”) at error.c:226
#7 0x080cd770 in sigsegv (sig=11) at signal.c:551
#8 0xb7fea440 in ?? ()
#9 0x0000000b in ?? ()
#10 0xbfffdd2c in ?? ()
#11 0xbfffddac in ?? ()
#12 0x0000000b in ?? ()
#13 0x00000000 in ?? ()
(gdb)

This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.