[ruby-dev:24408] open dumps core

次のようにすると core を吐きます。

% ./ruby -e '
def fin(&block) ObjectSpace.define_finalizer(Object.new, &block) end
f = [File.open("/dev/null")]
begin
  loop { File.sysopen("/dev/null") }
rescue Errno::EMFILE
end
f.clear
mode = "\0" * 0x20000
mode[0,1] = "r"
fin { mode.replace "" }
p open("/dev/null", mode)
'
-e:12: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-03) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
def fin(&block) ObjectSpace.define_finalizer(Object.new, &block) end'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e721 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e721 in kill () from /lib/libc.so.6
#1  0x4009e4c5 in raise () from /lib/libc.so.6
#2  0x4009f9e8 in abort () from /lib/libc.so.6
#3  0x080d22c6 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b0262 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x400de982 in _IO_file_fopen () from /lib/libc.so.6
#7  0x400d4ef9 in fgets () from /lib/libc.so.6
#8  0x400d725c in fopen64 () from /lib/libc.so.6
#9  0x08078151 in rb_fopen (fname=0x813a110 "/dev/null", mode=0x401d9008 <Address 0x401d9008 out of bounds>) at io.c:2489
#10 0x08078258 in rb_file_open_internal (io=1075607616, fname=0x813a110 "/dev/null", 
    mode=0x401d9008 <Address 0x401d9008 out of bounds>) at io.c:2555
#11 0x08078c2a in rb_open_file (argc=135504304, argv=0x813a1b0, io=1075607616) at io.c:3038
#12 0x0807a0e0 in rb_file_initialize (argc=2, argv=0xbfffea58, io=1075607616) at io.c:4054
#13 0x08069f7a in call_cfunc (func=0x807a060 <rb_file_initialize>, recv=1075607616, len=1075679240, argc=0, 
    argv=0xbfffea58) at eval.c:5368
#14 0x0805e187 in rb_call0 (klass=1075632796, recv=1075607616, id=2969, oid=135504304, argc=2, argv=0xbfffea58, 
    body=0x401cc0e8, nosuper=0) at eval.c:5509
#15 0x0805e438 in rb_call (klass=1075632796, recv=1075607616, mid=2969, argc=2, argv=0xbfffea58, scope=1) at eval.c:5730
#16 0x0805e85a in rb_funcall2 (recv=1075679240, mid=135504304, argc=135504304, argv=0x813a1b0) at ruby.h:635
#17 0x08060ff8 in rb_obj_call_init (obj=135504304, argc=135504304, argv=0x813a1b0) at eval.c:7149
#18 0x08086f9c in rb_class_new_instance (argc=135504304, argv=0x813a1b0, klass=135504304) at object.c:1565
#19 0x08078c62 in rb_io_s_open (argc=135504304, argv=0x813a1b0, klass=135504304) at io.c:3062
#20 0x08078e55 in rb_f_open (argc=2, argv=0xbfffea58) at io.c:3213
#21 0x08069f7a in call_cfunc (func=0x8078d70 <rb_f_open>, recv=1075673496, len=1075679240, argc=0, argv=0xbfffea58)
    at eval.c:5368
#22 0x0805e187 in rb_call0 (klass=1075678376, recv=1075673496, id=7353, oid=135504304, argc=2, argv=0xbfffea58, 
    body=0x401cedac, nosuper=0) at eval.c:5509
#23 0x0805e438 in rb_call (klass=1075678376, recv=1075673496, mid=7353, argc=2, argv=0xbfffea58, scope=1) at eval.c:5730
#24 0x08059368 in rb_eval (self=1075673496, n=0x813a1b0) at ruby.h:635
#25 0x08059698 in rb_eval (self=1075673496, n=0x813a1b0) at ruby.h:664
#26 0x080558fb in ruby_exec () at eval.c:1458
#27 0x08055940 in ruby_run () at eval.c:1484
#28 0x08053a05 in main (argc=135504304, argv=0x813a1b0, envp=0xbffff894) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]