[ruby-list:33152] ruby が core を吐く

こんにちは。

　次のスクリプトを実行すると，rubyが落ちてcoreを吐きます。でも，なぜ落
ちるのか，さっぱり分かりません。どうしたもんでしょうか？

　PATHをworld writableにしなければ落ちません。

-------------------ここから------------------------
require "runit/testcase"
require "runit/cui/testrunner"

def safe(level)
  result = nil
  Thread.start {
    $SAFE = level
    result = yield
  }.join
  result
end

class SafeLevelTest < RUNIT::TestCase
  def sf(level, &block) # fail test
    assert_no_exception(SecurityError) { safe(level - 1, &block) }
    assert_exception(SecurityError) { safe(level, &block) }
  end

  def sp(level, &block) # pass test
    assert_no_exception(SecurityError) { safe(level, &block) }
  end

  def setup
    Dir.rmdir 'test' if FileTest.directory? 'test'
  end
  
  def test1e
    ENV['PATH'] = '/tmp' #DEBUG
    sp(1) {
      s = "ls"; assert_equal(false, s.tainted?)
      system(s)
    }
  end

  def test2a1
    # Dir.chrootが無条件に失敗する
    Dir.mkdir('test')
    sf(2) { Dir.chroot('test') }
  end
end

RUNIT::CUI::TestRunner.run(SafeLevelTest.suite)
----------------ここまで----------------

画面；
---------------ここから--------------------
SafeLevelTest#test1e F.
SafeLevelTest#test2a1 E.
Time: 0.026739
FAILURES!!!
Test Results:
 Run: 2/2(3 asserts) Failures: 1 Errors: 1
Failures: 1
tmp.rb:21:in `sp'(SafeLevelTest): Exception raised:#<SecurityError: 
Insecure PATH - ls> (RUNIT::AssertionFailedError)
        from tmp.rb:30:in `test1e'
        from tmp.rb:43
Errors: 1
tmp.rb:39:in `chroot'(SafeLevelTest): Operation not permitted - 
"test" (Errno::EPERM)
        from tmp.rb:7:in `join'
        from tmp.rb:7:in `safe'
        from tmp.rb:16:in `sf'
        from tmp.rb:16:in `assert_no_exception'
        from tmp.rb:16:in `sf'
        from tmp.rb:39:in `test2a1'
        from tmp.rb:43
[BUG] Segmentation fault
ruby 1.6.6 (2001-12-31) [i586-linux]
---------------ここまで-------------------

環境
ruby 1.6.6 (2001-12-31) [i586-linux]

bt:
#0  0x4014e861 in kill () from /lib/libc.so.6
#1  0x4014e545 in raise () from /lib/libc.so.6
#2  0x4014fd01 in abort () from /lib/libc.so.6
#3  0x4003775f in rb_bug (fmt=0x400ba459 "Segmentation fault") at error.c:178
#4  0x40096020 in sigpipe (sig=11) at signal.c:393
#5  0x4014e798 in sigaction () from /lib/libc.so.6
Cannot access memory at address 0xa.

-- 
HORIKAWA Hisashi (堀川 久)
http://www2.airnet.ne.jp/pak04955/
mailto:[e-mail]