diff --git a/ChangeLog b/ChangeLog
index c5fb4e5a68..8345f05100 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+Thu Nov  4 09:11:35 2004  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* gc.c (gc_mark): enable GC stack checking.
+
+Thu Nov  4 03:11:33 2004  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* string.c (str_gsub): lock strings temporarily.  [ruby-dev:24687]
+
+	* ext/socket/socket.c (s_recvfrom): tmplock input buffer.
+	  [ruby-dev:24705]
+
 Wed Nov  3 22:24:17 2004  GOTOU Yuuzou  <gotoyuzo@notwork.org>
 
 	* lib/webrick/httpauth/digestauth.rb: use Base64.encode64 to
diff --git a/ext/socket/socket.c b/ext/socket/socket.c
index 5c57f2e1f1..4cc9adc072 100644
--- a/ext/socket/socket.c
+++ b/ext/socket/socket.c
@@ -474,10 +474,12 @@ s_recvfrom(sock, argc, argv, from)
     str = rb_tainted_str_new(0, buflen);
 
   retry:
+    rb_str_locktmp(str);
     rb_thread_wait_fd(fd);
     TRAP_BEG;
     slen = recvfrom(fd, RSTRING(str)->ptr, buflen, flags, (struct sockaddr*)buf, &alen);
     TRAP_END;
+    rb_str_unlocktmp(str);
 
     if (slen < 0) {
 	if (rb_io_wait_readable(fd)) {
diff --git a/gc.c b/gc.c
index e7c4130bfb..71e2225609 100644
--- a/gc.c
+++ b/gc.c
@@ -648,7 +648,7 @@ mark_tbl(tbl, lev)
     int lev;
 {
     if (!tbl) return;
-    st_foreach(tbl, mark_entry, lev+1);
+    st_foreach(tbl, mark_entry, lev);
 }
 
 void
@@ -675,7 +675,7 @@ mark_hash(tbl, lev)
     int lev;
 {
     if (!tbl) return;
-    st_foreach(tbl, mark_keyvalue, lev+1);
+    st_foreach(tbl, mark_keyvalue, lev);
 }
 
 void
@@ -721,7 +721,7 @@ gc_mark(ptr, lev)
 	}
 	return;
     }
-    gc_mark_children(ptr, lev);
+    gc_mark_children(ptr, lev+1);
 }
 
 void
diff --git a/string.c b/string.c
index 6592421f43..d36f82ba46 100644
--- a/string.c
+++ b/string.c
@@ -464,6 +464,7 @@ str_independent(str)
     VALUE str;
 {
     if (FL_TEST(str, STR_TMPLOCK)) {
+	FL_UNSET(str, STR_TMPLOCK);
 	rb_raise(rb_eRuntimeError, "can't modify string; temporarily locked");
     }
     if (OBJ_FROZEN(str)) rb_error_frozen("string");
@@ -2075,6 +2076,8 @@ str_gsub(argc, argv, str, bang)
     bp = buf;
     cp = RSTRING(str)->ptr;
 
+    rb_str_locktmp(str);
+    rb_str_locktmp(dest);
     while (beg >= 0) {
 	n++;
 	match = rb_backref_get();
@@ -2132,6 +2135,8 @@ str_gsub(argc, argv, str, bang)
     }
     rb_backref_set(match);
     *bp = '\0';
+    rb_str_unlocktmp(str);
+    rb_str_unlocktmp(dest);
     if (bang) {
 	if (str_independent(str)) {
 	    free(RSTRING(str)->ptr);