[ruby-dev:24919] File.new dumps core

次のようにすると core を吐きます。

% ./ruby -de '
string = "/dev/null"
th = nil
string.gsub!(/\z/) {
  fname = nil
  ObjectSpace.each_object(String) {|o|
    if o.length == 39 && /\A\0+\z/ =~ o
      fname = o
    end
  }
  perm = Object.new
  class << perm; self end.send(:define_method, :to_int) {
    Thread.pass
    0666
  }
  th = Thread.new {
    File.new(fname, "r", perm)
  }
}
th.join
'
-e:17: [BUG] Segmentation fault
ruby 1.9.0 (2004-11-18) [i686-linux]

zsh: abort (core dumped)  ./ruby -de 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -de 
string = "/dev/null"
th = nil
string.gsub!(/\z/) {
  fname = nil
 '.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e6b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e6b1 in kill () from /lib/libc.so.6
#1  0x4009e435 in raise () from /lib/libc.so.6
#2  0x4009f978 in abort () from /lib/libc.so.6
#3  0x080d55c6 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b2642 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x400eab9f in strlen () from /lib/libc.so.6
#7  0x080c2f4a in ruby_strdup (str=0x0) at util.c:630
#8  0x080794da in rb_file_sysopen_internal (io=1075606256, fname=0x0, flags=0, mode=0) at io.c:2616
#9  0x08079c20 in rb_open_file (argc=0, argv=0x0, io=1075606256) at io.c:3025
#10 0x0807b1b0 in rb_file_initialize (argc=3, argv=0xbfffc498, io=1075606256) at io.c:4046
#11 0x0806a92a in call_cfunc (func=0x807b130 <rb_file_initialize>, recv=1075606256, len=135549304, argc=-1, 
    argv=0xbfffc498) at eval.c:5385
#12 0x0805e872 in rb_call0 (klass=1075632836, recv=1075606256, id=2969, oid=0, argc=3, argv=0xbfffc498, body=0x401cc110, 
    nosuper=0) at eval.c:5526
#13 0x0805eb28 in rb_call (klass=1075632836, recv=1075606256, mid=2969, argc=3, argv=0xbfffc498, scope=1) at eval.c:5747
#14 0x0805ef4a in rb_funcall2 (recv=135549304, mid=0, argc=0, argv=0x0) at ruby.h:635
#15 0x08061728 in rb_obj_call_init (obj=0, argc=0, argv=0x0) at eval.c:7168
#16 0x0808823c in rb_class_new_instance (argc=0, argv=0x0, klass=0) at object.c:1564
#17 0x0806a92a in call_cfunc (func=0x807b1e0 <rb_io_s_new>, recv=1075632836, len=135549304, argc=-1, argv=0xbfffc498)
    at eval.c:5385
#18 0x0805e872 in rb_call0 (klass=1075636696, recv=1075632836, id=3377, oid=0, argc=3, argv=0xbfffc498, body=0x401ce988, 
    nosuper=0) at eval.c:5526
#19 0x0805eb28 in rb_call (klass=1075636696, recv=1075632836, mid=3377, argc=3, argv=0xbfffc498, scope=0) at eval.c:5747
#20 0x080598ea in rb_eval (self=1075673536, n=0x0) at ruby.h:635
#21 0x0805c877 in rb_yield_0 (val=1075606356, self=1075673536, klass=1075606996, flags=1, avalue=2) at eval.c:4726
#22 0x08068cff in rb_thread_yield (arg=0, th=0x813d888) at eval.c:11541
#23 0x08068b96 in rb_thread_start_0 (fn=0x8068c50 <rb_thread_yield>, arg=0x401c7354, th=0x813d888) at eval.c:11460
#24 0x08068de1 in rb_thread_initialize (thread=0, args=0) at eval.c:11607
#25 0x0806a902 in call_cfunc (func=0x8068db0 <rb_thread_initialize>, recv=1075606376, len=135549304, argc=-1, argv=0x0)
    at eval.c:5382
#26 0x0805e872 in rb_call0 (klass=1075662536, recv=1075606376, id=2969, oid=0, argc=0, argv=0x0, body=0x401d4e64, 
    nosuper=0) at eval.c:5526
#27 0x0805eb28 in rb_call (klass=1075662536, recv=1075606376, mid=2969, argc=0, argv=0x0, scope=1) at eval.c:5747
#28 0x0805ef4a in rb_funcall2 (recv=135549304, mid=0, argc=0, argv=0x0) at ruby.h:635
#29 0x08061728 in rb_obj_call_init (obj=0, argc=0, argv=0x0) at eval.c:7168
#30 0x08068d65 in rb_thread_s_new (argc=0, argv=0x0, klass=1075662536) at eval.c:11572
#31 0x0806a92a in call_cfunc (func=0x8068d30 <rb_thread_s_new>, recv=1075662536, len=135549304, argc=-1, argv=0x0)
    at eval.c:5385
---Type <return> to continue, or q <return> to quit---
#32 0x0805e872 in rb_call0 (klass=1075662516, recv=1075662536, id=3377, oid=0, argc=0, argv=0x0, body=0x401d4e8c, 
    nosuper=0) at eval.c:5526
#33 0x0805eb28 in rb_call (klass=1075662516, recv=1075662536, mid=3377, argc=0, argv=0x0, scope=0) at eval.c:5747
#34 0x080598ea in rb_eval (self=1075673536, n=0x0) at ruby.h:635
#35 0x08058c99 in rb_eval (self=1075673536, n=0x0) at eval.c:2929
#36 0x08059179 in rb_eval (self=1075673536, n=0x0) at eval.c:3379
#37 0x0805c877 in rb_yield_0 (val=1075606636, self=1075673536, klass=1075606856, flags=0, avalue=0) at eval.c:4726
#38 0x0805cda9 in rb_yield (val=0) at eval.c:4808
#39 0x080b8ccf in str_gsub (argc=0, argv=0x0, str=1075606696, bang=1) at string.c:2091
#40 0x080b91a8 in rb_str_gsub_bang (argc=0, argv=0x0, str=0) at string.c:2183
#41 0x0806a92a in call_cfunc (func=0x80b9180 <rb_str_gsub_bang>, recv=1075606696, len=135549304, argc=-1, argv=0xbfffea18)
    at eval.c:5385
#42 0x0805e872 in rb_call0 (klass=1075668916, recv=1075606696, id=4631, oid=0, argc=1, argv=0xbfffea18, body=0x401d5d3c, 
    nosuper=0) at eval.c:5526
#43 0x0805eb28 in rb_call (klass=1075668916, recv=1075606696, mid=4631, argc=1, argv=0xbfffea18, scope=0) at eval.c:5747
#44 0x080598ea in rb_eval (self=1075673536, n=0x0) at ruby.h:635
#45 0x08058c99 in rb_eval (self=1075673536, n=0x0) at eval.c:2929
#46 0x08055e3d in ruby_exec_internal () at eval.c:1465
#47 0x08055e56 in ruby_exec () at eval.c:1483
#48 0x08055ea0 in ruby_run () at eval.c:1500
#49 0x08053ea5 in main (argc=0, argv=0x0, envp=0xbffff844) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]