[ruby-dev:24515] Marshal.load causes core dump

次のようにすると core を吐きます。

% ./ruby -e '
class C < String
end
str = Marshal.dump(C.new)
class Object
  remove_const(:C)
end
class C < Symbol
end
def C.<(s)
  true
end
o = Marshal.load(str)
p o
'
-e:14: [BUG] Segmentation fault
ruby 1.9.0 (2004-10-18) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
class C < String
end
str = Marshal.dump(C.new)
class Object
  remove'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e741 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e741 in kill () from /lib/libc.so.6
#1  0x4009e4c5 in raise () from /lib/libc.so.6
#2  0x4009fa08 in abort () from /lib/libc.so.6
#3  0x080d2486 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b03c2 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x400eac2f in strlen () from /lib/libc.so.6
#7  0x08086a67 in sym_inspect (sym=1075607436) at object.c:1132
#8  0x08069f61 in call_cfunc (func=0x8086a40 <sym_inspect>, recv=1075607436, len=173, argc=-1, argv=0x0) at eval.c:5370
#9  0x0805e167 in rb_call0 (klass=1075675596, recv=1075607436, id=3169, oid=0, argc=0, argv=0x0, body=0x401d8104, 
    nosuper=0) at eval.c:5508
#10 0x0805e418 in rb_call (klass=1075675596, recv=1075607436, mid=3169, argc=0, argv=0x0, scope=1) at eval.c:5729
#11 0x0805e794 in rb_funcall (recv=1075607436, mid=0, n=0) at ruby.h:635
#12 0x08086186 in rb_inspect (obj=0) at object.c:345
#13 0x08079b61 in rb_p (obj=0) at io.c:3746
#14 0x08079c12 in rb_f_p (argc=1, argv=0xbffff138) at io.c:3776
#15 0x08069f5a in call_cfunc (func=0x8079ba0 <rb_f_p>, recv=1075673496, len=173, argc=-1, argv=0xbffff138) at eval.c:5367
#16 0x0805e167 in rb_call0 (klass=1075678376, recv=1075673496, id=7417, oid=0, argc=1, argv=0xbffff138, body=0x401cea3c, 
    nosuper=0) at eval.c:5508
#17 0x0805e418 in rb_call (klass=1075678376, recv=1075673496, mid=7417, argc=1, argv=0xbffff138, scope=1) at eval.c:5729
#18 0x08059348 in rb_eval (self=1075673496, n=0x0) at ruby.h:635
#19 0x080558db in ruby_exec () at eval.c:1458
#20 0x08055920 in ruby_run () at eval.c:1484
#21 0x080539e5 in main (argc=0, argv=0x0, envp=0xbffff904) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]