[ruby-dev:24861] Array#[]= causes core dump

次のようにすると core を吐きます。

% ./ruby -e '
arr = [1,2,3,4]
o = Object.new
arr2 = nil
class << o; self end.send(:define_method, :to_ary) {
  arr.freeze
  arr2 = arr.dup
  [0] * 80
}
arr[1,2] = o
p arr
p arr2
'
[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]
[1, 0, 0, 0]
free(): invalid pointer 0x813cf20!
-e:12: [BUG] Segmentation fault
ruby 1.9.0 (2004-11-15) [i686-linux]

zsh: abort (core dumped)  ./ruby -e 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e 
arr = [1,2,3,4]
o = Object.new
arr2 = nil
class << o; self end.send('.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e6b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e6b1 in kill () from /lib/libc.so.6
#1  0x4009e435 in raise () from /lib/libc.so.6
#2  0x4009f978 in abort () from /lib/libc.so.6
#3  0x080d5456 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b2402 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  frame_free (frame=0x1) at eval.c:7750
#7  0x08062a1b in blk_free (data=0x813ceb0) at eval.c:7762
#8  0x080720a5 in rb_gc_call_finalizer_at_exit () at gc.c:1846
#9  0x08055bd4 in ruby_finalize_1 () at eval.c:1406
#10 0x08055ce3 in ruby_cleanup (ex=0) at eval.c:1441
#11 0x08055e41 in ruby_stop (ex=1) at eval.c:1490
#12 0x08055e8f in ruby_run () at eval.c:1502
#13 0x08053e85 in main (argc=1, argv=0x1, envp=0xbffff8f4) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]