diff --git a/ChangeLog b/ChangeLog
index 40bc30a48a..9683193882 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Sat Oct  7 23:33:02 2006  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* eval.c (formal_assign): packed post splat arguments may conflict
+	  with normal arguments.  [ruby-core:09021]
+
+	* eval.c (rb_call0): ditto.
+
 Sat Oct  7 11:53:04 2006  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* object.c (rb_mod_initialize): since module_eval no longer passes
diff --git a/eval.c b/eval.c
index 9e788df9e1..12f852f776 100644
--- a/eval.c
+++ b/eval.c
@@ -5678,6 +5678,7 @@ formal_assign(VALUE recv, NODE *node, int argc, const VALUE *argv, VALUE *local_
 	    v = rb_ary_new4(argc,argv);
 	    n += npost;
 	    i += n*256;
+	    i = -i;
 	}
 	else {
 	    v = rb_ary_new2(0);
@@ -5719,11 +5720,13 @@ rb_call0(VALUE klass, VALUE recv, ID id, ID oid,
 	stack_check();
 	rb_gc_finalize_deferred();
     }
-    if (argc >= 256) {
+    if (argc < 0) {
 	VALUE tmp;
 	VALUE *nargv;
-	int n = argc / 256 - 1;
+	int n;
 
+	argc = -argc;
+	n = argc / 256 - 1;
 	argc %= 256;
 	tmp = svalue_to_avalue(argv[argc]);
 	nargv = TMP_ALLOC(argc + RARRAY_LEN(tmp) + n);