diff --git a/ChangeLog b/ChangeLog
index 43fa879666..51d01b95ab 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Fri Jun 12 02:41:21 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* string.c (str_replace_shared): shared target must be frozen.
+	  [ruby-core:23727]
+
 Thu Jun 11 21:05:09 2009  Tadayoshi Funaba  <tadf@dotrb.org>
 
 	* lib/cmath.rb (exp): omitted redundant function call.
diff --git a/string.c b/string.c
index 58d510fe3b..c9621d399d 100644
--- a/string.c
+++ b/string.c
@@ -14,6 +14,7 @@
 #include "ruby/ruby.h"
 #include "ruby/re.h"
 #include "ruby/encoding.h"
+#include <assert.h>
 
 #define BEG(no) regs->beg[no]
 #define END(no) regs->end[no]
@@ -599,6 +600,7 @@ str_replace_shared(VALUE str2, VALUE str)
     }
     else {
 	FL_SET(str2, STR_NOEMBED);
+	str = rb_str_new_frozen(str);
 	RSTRING(str2)->as.heap.len = RSTRING_LEN(str);
 	RSTRING(str2)->as.heap.ptr = RSTRING_PTR(str);
 	RSTRING(str2)->as.heap.aux.shared = str;
@@ -643,8 +645,10 @@ str_new4(VALUE klass, VALUE str)
     RSTRING(str2)->as.heap.len = RSTRING_LEN(str);
     RSTRING(str2)->as.heap.ptr = RSTRING_PTR(str);
     if (STR_SHARED_P(str)) {
+	VALUE shared = RSTRING(str)->as.heap.aux.shared;
+	assert(OBJ_FROZEN(shared));
 	FL_SET(str2, ELTS_SHARED);
-	RSTRING(str2)->as.heap.aux.shared = RSTRING(str)->as.heap.aux.shared;
+	RSTRING(str2)->as.heap.aux.shared = shared;
     }
     else {
 	FL_SET(str, ELTS_SHARED);
@@ -664,6 +668,7 @@ rb_str_new_frozen(VALUE orig)
     klass = rb_obj_class(orig);
     if (STR_SHARED_P(orig) && (str = RSTRING(orig)->as.heap.aux.shared)) {
 	long ofs;
+	assert(OBJ_FROZEN(str));
 	ofs = RSTRING_LEN(str) - RSTRING_LEN(orig);
 	if ((ofs > 0) || (klass != RBASIC(str)->klass) ||
 	    (!OBJ_TAINTED(str) && OBJ_TAINTED(orig))) {
@@ -824,12 +829,14 @@ str_replace(VALUE str, VALUE str2)
 	str2 = rb_str_new4(str2);
     }
     if (STR_SHARED_P(str2)) {
+	VALUE shared = RSTRING(str2)->as.heap.aux.shared;
+	assert(OBJ_FROZEN(shared));
 	STR_SET_NOEMBED(str);
 	RSTRING(str)->as.heap.len = len;
 	RSTRING(str)->as.heap.ptr = RSTRING_PTR(str2);
 	FL_SET(str, ELTS_SHARED);
 	FL_UNSET(str, STR_ASSOC);
-	RSTRING(str)->as.heap.aux.shared = RSTRING(str2)->as.heap.aux.shared;
+	RSTRING(str)->as.heap.aux.shared = shared;
     }
     else {
 	str_replace_shared(str, str2);
diff --git a/version.h b/version.h
index 75d8f678e2..26b9b65819 100644
--- a/version.h
+++ b/version.h
@@ -1,5 +1,5 @@
 #define RUBY_VERSION "1.9.2"
-#define RUBY_RELEASE_DATE "2009-06-11"
+#define RUBY_RELEASE_DATE "2009-06-12"
 #define RUBY_PATCHLEVEL -1
 #define RUBY_BRANCH_NAME "trunk"
 
@@ -8,7 +8,7 @@
 #define RUBY_VERSION_TEENY 1
 #define RUBY_RELEASE_YEAR 2009
 #define RUBY_RELEASE_MONTH 6
-#define RUBY_RELEASE_DAY 11
+#define RUBY_RELEASE_DAY 12
 
 #include "ruby/version.h"