[ruby-dev:24400] IO#read with 1 argument dumps core

次のようにすると core を吐きます。

% ./ruby -d -e '
r, w = IO.pipe
Thread.new {
  Thread.pass;
  ObjectSpace.each_object(String) {|s| s.replace "" if s.length == 4096 }
  w << "a" * 4096 }
r.read(4096)
'
-e:7: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-02) [i686-linux]

-e:7: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-02) [i686-linux]

zsh: abort      ./ruby -d -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
arr = (1..100).to_a
$res = arr.sort_by {|v|
  callcc {|k| $k = k } u'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e721 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e721 in kill () from /lib/libc.so.6
#1  0x4009e4c5 in raise () from /lib/libc.so.6
#2  0x4009f9e8 in abort () from /lib/libc.so.6
#3  0x080d22c6 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b0262 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  st_lookup (table=0x23000000, key=3169, value=0xbfffcda8) at st.c:258
#7  0x08054133 in search_method (klass=135502425, id=3169, origin=0xbfffcdd4) at eval.c:380
#8  0x08054189 in rb_get_method_body (klassp=0xbfffce30, idp=0xbfffce14, noexp=0xbfffce18) at eval.c:401
#9  0x0805e38a in rb_call (klass=135502425, recv=1075599836, mid=3169, argc=0, argv=0x0, scope=1) at eval.c:5706
#10 0x0805e7b4 in rb_funcall (recv=1075599836, mid=587202560, n=0) at ruby.h:635
#11 0x08086056 in rb_inspect (obj=587202560) at object.c:345
#12 0x080c57c1 in inspect_ary (ary=1075608056) at array.c:1546
#13 0x080c5528 in inspect_call (arg=0x23000000) at array.c:1465
#14 0x0805d509 in rb_ensure (b_proc=0x80c5510 <inspect_call>, data1=3221213120, e_proc=0x80c5610 <inspect_ensure>, 
    data2=1075608056) at eval.c:5177
#15 0x080c56cf in rb_protect_inspect (func=0x80c5720 <inspect_ary>, obj=1075608056, arg=0) at array.c:1522
#16 0x080c5876 in rb_ary_inspect (ary=1075608056) at array.c:1569
#17 0x08069f81 in call_cfunc (func=0x80c5820 <rb_ary_inspect>, recv=1075608056, len=587202560, argc=135291248, argv=0x0)
    at eval.c:5371
#18 0x0805e187 in rb_call0 (klass=1075647616, recv=1075608056, id=3169, oid=587202560, argc=0, argv=0x0, body=0x401d137c, 
    nosuper=0) at eval.c:5509
#19 0x0805e438 in rb_call (klass=1075647616, recv=1075608056, mid=3169, argc=0, argv=0x0, scope=1) at eval.c:5730
#20 0x0805e7b4 in rb_funcall (recv=1075608056, mid=587202560, n=0) at ruby.h:635
#21 0x08086056 in rb_inspect (obj=587202560) at object.c:345
#22 0x08079aa1 in rb_p (obj=587202560) at io.c:3751
#23 0x08079b52 in rb_f_p (argc=1, argv=0xbfffd4e8) at io.c:3781
#24 0x08069f7a in call_cfunc (func=0x8079ae0 <rb_f_p>, recv=1075673496, len=587202560, argc=135291248, argv=0xbfffd4e8)
    at eval.c:5368
#25 0x0805e187 in rb_call0 (klass=1075678376, recv=1075673496, id=7417, oid=587202560, argc=1, argv=0xbfffd4e8, 
    body=0x401cea3c, nosuper=0) at eval.c:5509
#26 0x0805e438 in rb_call (klass=1075678376, recv=1075673496, mid=7417, argc=1, argv=0xbfffd4e8, scope=1) at eval.c:5730
#27 0x08059368 in rb_eval (self=1075673496, n=0x23000000) at ruby.h:635
#28 0x0805c213 in rb_yield_0 (val=5, self=1075673496, klass=1075608396, flags=0, avalue=0) at eval.c:4709
#29 0x0805c6f9 in rb_yield (val=587202560) at eval.c:4791
#30 0x080d1094 in sort_by_i (i=5, ary=587202560) at enum.c:395
#31 0x0805c477 in rb_yield_0 (val=5, self=1075673496, klass=1075608036, flags=0, avalue=0) at eval.c:4706
#32 0x0805c6f9 in rb_yield (val=587202560) at eval.c:4791
#33 0x080c507f in rb_ary_each (ary=1075608096) at array.c:1242
---Type <return> to continue, or q <return> to quit---
#34 0x08069f81 in call_cfunc (func=0x80c5050 <rb_ary_each>, recv=1075608096, len=587202560, argc=135291248, argv=0x0)
    at eval.c:5371
#35 0x0805e187 in rb_call0 (klass=1075647616, recv=1075608096, id=3873, oid=587202560, argc=0, argv=0x0, body=0x401d105c, 
    nosuper=0) at eval.c:5509
#36 0x0805e438 in rb_call (klass=1075647616, recv=1075608096, mid=3873, argc=0, argv=0x0, scope=1) at eval.c:5730
#37 0x0805e7b4 in rb_funcall (recv=1075608096, mid=587202560, n=0) at ruby.h:635
#38 0x080d0a96 in rb_each (obj=587202560) at enum.c:24
#39 0x0805cee9 in rb_iterate (it_proc=0x80d0a70 <rb_each>, data1=1075608096, bl_proc=0x23000000, data2=587202560)
    at eval.c:5022
#40 0x080d11a8 in enum_sort_by (obj=1075608096) at enum.c:497
#41 0x08069f81 in call_cfunc (func=0x80d1140 <enum_sort_by>, recv=1075608096, len=587202560, argc=135291248, argv=0x0)
    at eval.c:5371
#42 0x0805e187 in rb_call0 (klass=1075672676, recv=1075608096, id=3713, oid=587202560, argc=0, argv=0x0, body=0x401d75d8, 
    nosuper=0) at eval.c:5509
#43 0x0805e438 in rb_call (klass=1075672676, recv=1075608096, mid=3713, argc=0, argv=0x0, scope=0) at eval.c:5730
#44 0x08059368 in rb_eval (self=1075673496, n=0x23000000) at ruby.h:635
#45 0x08058718 in rb_eval (self=1075673496, n=0x23000000) at eval.c:2924
#46 0x08058c9a in rb_eval (self=1075673496, n=0x23000000) at eval.c:3389
#47 0x080558fb in ruby_exec () at eval.c:1458
#48 0x08055940 in ruby_run () at eval.c:1484
#49 0x08053a05 in main (argc=587202560, argv=0x23000000, envp=0xbffff934) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]