[ruby-dev:24940] String#[]= dumps core again

次のようにすると core を吐きます。

% limit stacksize 10m 
% ./ruby -e '         
str = "abcd"
val = Object.new
class << val; self end.send(:define_method, :to_str) {
  str.clear
  "a" * 100
}
str[1,2] = val
p str
'
zsh: segmentation fault (core dumped)  ./ruby -e 
% gdb ruby core
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -e          
str = "abcd"
val = Object.new
class << val; self end.send(:'.
Program terminated with signal 11, Segmentation fault.
#0  rb_bug (fmt=0x2000 <Address 0x2000 out of bounds>) at error.c:203
203         int len = err_position(buf, BUFSIZ);
(gdb) bt
#0  rb_bug (fmt=0x2000 <Address 0x2000 out of bounds>) at error.c:203
#1  0x080b2642 in sigsegv (sig=11) at signal.c:446
#2  0x4009e5e8 in ?? ()
#3  0x0000000b in ?? ()
#4  0x00000000 in ?? ()
#5  0x00000000 in ?? ()
#6  0x0000002b in ?? ()
#7  0x0000002b in ?? ()
#8  0xbf600e04 in ?? ()
#9  0xbf600e04 in ?? ()
#10 0xbf600ddc in ?? ()
#11 0xbf600db0 in ?? ()
#12 0x00002000 in ?? ()
#13 0xe9ec401c in ?? ()
#14 0x3ffef7f2 in ?? ()
#15 0x080fa704 in ruby_digitmap ()
#16 0x0000000e in ?? ()
#17 0x00000004 in ?? ()
#18 0x39520805 in ?? ()
#19 0x00000023 in ?? ()
#20 0x00010682 in ?? ()
#21 0xbf600db0 in ?? ()
#22 0x0000002b in ?? ()
#23 0x00000000 in ?? ()
#24 0x00000000 in ?? ()
#25 0x39520805 in ?? ()
#26 0x00000000 in ?? ()
#27 0x00000000 in ?? ()
#28 0x00000000 in ?? ()
#29 0x00000000 in ?? ()
#30 0x00000000 in ?? ()
#31 0x00000000 in ?? ()
#32 0x00000000 in ?? ()
#33 0x00000000 in ?? ()
#34 0x00000000 in ?? ()
#35 0x00000000 in ?? ()
#36 0x00000000 in ?? ()
#37 0x00000000 in ?? ()
#38 0x00000000 in ?? ()
---Type <return> to continue, or q <return> to quit---
...
-- 
[田中 哲][たなか あきら][Tanaka Akira]