Index: target-i386/op_helper.c
===================================================================
--- target-i386/op_helper.c	(revision 5805)
+++ target-i386/op_helper.c	(working copy)
@@ -210,7 +210,7 @@
 /* XXX: merge with load_seg() */
 static void tss_load_seg(int seg_reg, int selector)
 {
-    uint32_t e1, e2;
+    uint32_t e1 = 0, e2 = 0;
     int rpl, dpl, cpl;
 
     if ((selector & 0xfffc) != 0) {
@@ -638,7 +638,7 @@
     target_ulong ptr, ssp;
     int type, dpl, selector, ss_dpl, cpl;
     int has_error_code, new_stack, shift;
-    uint32_t e1, e2, offset, ss, esp, ss_e1, ss_e2;
+    uint32_t e1, e2, offset, ss = 0, esp, ss_e1 = 0, ss_e2 = 0;
     uint32_t old_eip, sp_mask;
 
     has_error_code = 0;
@@ -2159,7 +2159,7 @@
                            int next_eip_addend)
 {
     int gate_cs, type;
-    uint32_t e1, e2, cpl, dpl, rpl, limit;
+    uint32_t e1 = 0, e2 = 0, cpl, dpl, rpl, limit;
     target_ulong next_eip;
 
     if ((new_cs & 0xfffc) == 0)
@@ -2275,8 +2275,8 @@
                             int shift, int next_eip_addend)
 {
     int new_stack, i;
-    uint32_t e1, e2, cpl, dpl, rpl, selector, offset, param_count;
-    uint32_t ss, ss_e1, ss_e2, sp, type, ss_dpl, sp_mask;
+    uint32_t e1 = 0, e2 = 0, cpl, dpl, rpl, selector, offset, param_count;
+    uint32_t ss = 0, ss_e1 = 0, ss_e2 = 0, sp, type, ss_dpl, sp_mask;
     uint32_t val, limit, old_sp_mask;
     target_ulong ssp, old_ssp, next_eip;
 
@@ -2552,7 +2552,7 @@
 {
     uint32_t new_cs, new_eflags, new_ss;
     uint32_t new_es, new_ds, new_fs, new_gs;
-    uint32_t e1, e2, ss_e1, ss_e2;
+    uint32_t e1 = 0, e2 = 0, ss_e1 = 0, ss_e2 = 0;
     int cpl, dpl, rpl, eflags_mask, iopl;
     target_ulong ssp, sp, new_eip, new_esp, sp_mask;
 
@@ -2753,7 +2753,7 @@
 void helper_iret_protected(int shift, int next_eip)
 {
     int tss_selector, type;
-    uint32_t e1, e2;
+    uint32_t e1 = 0, e2 = 0;
 
     /* specific case for TSS */
     if (env->eflags & NT_MASK) {