[ruby-dev:24343] Array#flatten! dumps core

次のようにすると core を吐きます。

Z:akr@boron% ./ruby -e '
class A
  def initialize(a) @a = a end
  def to_ary() @a.replace [3,4,5]; nil end
end
a = (1..1000).to_a
a[90] = [A.new(a),*(1..1000)]
a.flatten!
'
-e:8: [BUG] Segmentation fault
ruby 1.9.0 (2004-09-24) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
Z:akr@boron% gdb ruby core
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

Core was generated by `./ruby -e 
class A
  def initialize(a) @a = a end
  def to_ary() @a.replace [3,'.
Program terminated with signal 6, Aborted.

warning: current_sos: Can't read pathname for load map: Input/output error

Reading symbols from /lib/tls/libdl.so.2...Reading symbols from /usr/lib/debug//lib/tls/libdl-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libdl.so.2
Reading symbols from /lib/tls/libcrypt.so.1...Reading symbols from /usr/lib/debug//lib/tls/libcrypt-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libcrypt.so.1
Reading symbols from /lib/tls/libm.so.6...Reading symbols from /usr/lib/debug//lib/tls/libm-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /lib/tls/libc.so.6...Reading symbols from /usr/lib/debug//lib/tls/libc-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...Reading symbols from /usr/lib/debug//lib/ld-2.3.2.so...done.
done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x40099ee9 in raise () from /lib/tls/libc.so.6
(gdb) bt
#0  0x40099ee9 in raise () from /lib/tls/libc.so.6
#1  0x4009b781 in abort () from /lib/tls/libc.so.6
#2  0x080d1d16 in rb_bug (fmt=0x0) at error.c:214
#3  0x080afd62 in sigsegv (sig=11) at signal.c:446
#4  <signal handler called>
#5  rb_check_convert_type (val=126, type=9, tname=0x80e0797 "Array", method=0x80f6541 "to_ary") at ruby.h:665
#6  0x080c37dc in rb_check_array_type (ary=28) at array.c:314
#7  0x080c7169 in flatten (ary=1075623980, idx=90, ary2=1075623940, memo=1075623800) at array.c:2999
#8  0x080c7222 in rb_ary_flatten_bang (ary=1075623980) at array.c:3043
#9  0x08069e91 in call_cfunc (func=0x80c71b0 <rb_ary_flatten_bang>, recv=1075623980, len=1075623980, argc=9, argv=0x0)
    at eval.c:5371
#10 0x0805e0a7 in rb_call0 (klass=1075664000, recv=1075623980, id=6823, oid=28, argc=0, argv=0x0, body=0x401d4954, 
    nosuper=0) at eval.c:5508
#11 0x0805e358 in rb_call (klass=1075664000, recv=1075623980, mid=6823, argc=0, argv=0x0, scope=0) at eval.c:5729
#12 0x08059288 in rb_eval (self=1075689880, n=0x1c) at ruby.h:635
#13 0x0805581b in ruby_exec () at eval.c:1458
#14 0x08055860 in ruby_run () at eval.c:1484
#15 0x08053925 in main (argc=28, argv=0x1c, envp=0xbffffaa4) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]