[ruby-dev:24727] String#gsub causes core dump again

次のようにすると core を吐きます。

% ./ruby -de '
def make_unlockable_string
  callcc {|$kk|
    dest = nil
    str = ""
    n = 0
    dest = str.gsub(/\z/) {
      callcc {|$k|}
      "b"
    }
    n += 1
    $k.call if n == 1
    $kk.call([dest, lambda { callcc {|$kk| $k.call } }])
  }
end
dest, unlock = make_unlockable_string
r, w = IO.pipe
Thread.new { r.read(dest.length, dest) }
unlock.call
dest.clear
w << "a" * 4096
'
-e:18: [BUG] Segmentation fault
ruby 1.9.0 (2004-11-05) [i686-linux]

zsh: abort (core dumped)  ./ruby -de 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -de 
def make_unlockable_string
  callcc {|$kk|
    dest = nil
    str ='.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e6b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e6b1 in kill () from /lib/libc.so.6
#1  0x4009e435 in raise () from /lib/libc.so.6
#2  0x4009f978 in abort () from /lib/libc.so.6
#3  0x080d4e96 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b1fa2 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  rb_io_fread (ptr=0x0, len=1, f=0x8144e60) at io.c:980
#7  0x080774df in io_read (argc=97, argv=0x61, io=97) at io.c:1219
#8  0x0806a81a in call_cfunc (func=0x80773f0 <io_read>, recv=1075605856, len=0, argc=135548512, argv=0xbfffdba8)
    at eval.c:5365
#9  0x0805e767 in rb_call0 (klass=1075636716, recv=1075605856, id=7329, oid=97, argc=2, argv=0xbfffdba8, body=0x401ce474, 
    nosuper=0) at eval.c:5506
#10 0x0805ea18 in rb_call (klass=1075636716, recv=1075605856, mid=7329, argc=2, argv=0xbfffdba8, scope=0) at eval.c:5727
#11 0x08059888 in rb_eval (self=1075673536, n=0x61) at ruby.h:633
#12 0x0805c7c3 in rb_yield_0 (val=1075605776, self=1075673536, klass=1075606676, flags=1, avalue=2) at eval.c:4706
#13 0x08068bef in rb_thread_yield (arg=97, th=0x8145168) at eval.c:11519
#14 0x08068a86 in rb_thread_start_0 (fn=0x8068b40 <rb_thread_yield>, arg=0x401c7110, th=0x8145168) at eval.c:11438
#15 0x08068cd1 in rb_thread_initialize (thread=97, args=97) at eval.c:11585
#16 0x0806a7f2 in call_cfunc (func=0x8068ca0 <rb_thread_initialize>, recv=1075605796, len=0, argc=135548512, argv=0x0)
    at eval.c:5362
#17 0x0805e767 in rb_call0 (klass=1075662536, recv=1075605796, id=2969, oid=97, argc=0, argv=0x0, body=0x401d4e64, 
    nosuper=0) at eval.c:5506
#18 0x0805ea18 in rb_call (klass=1075662536, recv=1075605796, mid=2969, argc=0, argv=0x0, scope=1) at eval.c:5727
#19 0x0805ee3a in rb_funcall2 (recv=0, mid=97, argc=97, argv=0x61) at ruby.h:633
#20 0x08061618 in rb_obj_call_init (obj=97, argc=97, argv=0x61) at eval.c:7148
#21 0x08068c55 in rb_thread_s_new (argc=97, argv=0x61, klass=1075662536) at eval.c:11550
#22 0x0806a81a in call_cfunc (func=0x8068c20 <rb_thread_s_new>, recv=1075662536, len=0, argc=135548512, argv=0x0)
    at eval.c:5365
#23 0x0805e767 in rb_call0 (klass=1075662516, recv=1075662536, id=3377, oid=97, argc=0, argv=0x0, body=0x401d4e8c, 
    nosuper=0) at eval.c:5506
#24 0x0805ea18 in rb_call (klass=1075662516, recv=1075662536, mid=3377, argc=0, argv=0x0, scope=0) at eval.c:5727
#25 0x08059888 in rb_eval (self=1075673536, n=0x61) at ruby.h:633
#26 0x08058c38 in rb_eval (self=1075673536, n=0x61) at eval.c:2920
#27 0x08055dbd in ruby_exec_internal () at eval.c:1456
#28 0x08055dd6 in ruby_exec () at eval.c:1474
#29 0x08055e20 in ruby_run () at eval.c:1491
#30 0x08053e45 in main (argc=97, argv=0x61, envp=0xbffff824) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]