[ruby-dev:25003] IO#flush dumps core again

次のようにすると core を吐きます。

% ./ruby -ve '
r, w = IO.pipe
w.sync = false
w << "a" * 4096
w.flush
pid = fork {
  w.close
  sleep 0.1
  Process.kill("USR1", Process.ppid)
  r.sysread(4096)
  sleep 0.1
  r.sysread(1000)
}
r.close
w << "b"
trap("USR1") { callcc {|k| $k = k } }
w.flush
w.close
$k.call
'
ruby 1.9.0 (2004-11-30) [i686-linux]
-e:17: [BUG] Segmentation fault
ruby 1.9.0 (2004-11-30) [i686-linux]

zsh: abort (core dumped)  ./ruby -ve 
% gdb ruby core 
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `./ruby -ve 
r, w = IO.pipe
w.sync = false
w << "a" * 4096
w.flush
pid = fork {
'.
Program terminated with signal 6, Aborted.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4009e6b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x4009e6b1 in kill () from /lib/libc.so.6
#1  0x4009e435 in raise () from /lib/libc.so.6
#2  0x4009f978 in abort () from /lib/libc.so.6
#3  0x080d59d6 in rb_bug (fmt=0x0) at error.c:214
#4  0x080b2a42 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x400e6cd5 in mallopt () from /lib/libc.so.6
#7  0x400e5e63 in malloc () from /lib/libc.so.6
#8  0x08070203 in ruby_xmalloc (size=1075466400) at gc.c:125
#9  0x080b5b47 in str_new (klass=0, ptr=0x401a50a0 "\001", len=19) at string.c:92
#10 0x080b5bb1 in rb_str_new (ptr=0x0, len=0) at string.c:105
#11 0x080b5be4 in rb_str_new2 (ptr=0x401954b8 "Bad file descriptor") at string.c:115
#12 0x080d6ae8 in syserr_initialize (argc=1075401912, argv=0xbfffee0c, self=1075605956) at error.c:965
#13 0x0806ab5a in call_cfunc (func=0x80d69a0 <syserr_initialize>, recv=1075605956, len=368, argc=1075466492, 
    argv=0xbfffee0c) at eval.c:5392
#14 0x0805e902 in rb_call0 (klass=1075662836, recv=1075605956, id=2969, oid=0, argc=1, argv=0xbfffee0c, body=0x401d4fcc, 
    nosuper=0) at eval.c:5533
#15 0x0805ebc8 in rb_call (klass=1075662836, recv=1075605956, mid=2969, argc=1, argv=0xbfffee0c, scope=1) at eval.c:5755
#16 0x0805f12a in rb_funcall2 (recv=368, mid=0, argc=0, argv=0x0) at ruby.h:635
#17 0x08061938 in rb_obj_call_init (obj=0, argc=0, argv=0x0) at eval.c:7219
#18 0x0808869c in rb_class_new_instance (argc=0, argv=0x0, klass=0) at object.c:1564
#19 0x080d758a in rb_sys_fail (mesg=0x0) at error.c:1171
#20 0x08076966 in io_fflush (f=0x813e750, fptr=0x813e728) at io.c:336
#21 0x08076dbd in rb_io_flush (io=1075606376) at io.c:580
#22 0x0806ab61 in call_cfunc (func=0x8076d80 <rb_io_flush>, recv=1075606376, len=368, argc=1075466492, argv=0x0)
    at eval.c:5395
#23 0x0805e902 in rb_call0 (klass=1075636716, recv=1075606376, id=7617, oid=0, argc=0, argv=0x0, body=0x401ce334, 
    nosuper=0) at eval.c:5533
#24 0x0805ebc8 in rb_call (klass=1075636716, recv=1075606376, mid=7617, argc=0, argv=0x0, scope=0) at eval.c:5755
#25 0x0805994a in rb_eval (self=1075673536, n=0x0) at ruby.h:635
#26 0x08055e8d in ruby_exec_internal () at eval.c:1469
#27 0x08055ea6 in ruby_exec () at eval.c:1487
#28 0x08055ef0 in ruby_run () at eval.c:1504
#29 0x08053ef5 in main (argc=0, argv=0x0, envp=0xbffff894) at main.c:38
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]