diff --git a/ChangeLog b/ChangeLog
index 6c3ecca8b5..99cd03b623 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sun Jun  6 10:44:34 2010  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* array.c (rb_ary_product): need to set the length in order to get
+	  the entries marked.  [ruby-dev:41540]
+
 Sun Jun  6 08:26:01 2010  Tanaka Akira  <akr@fsij.org>
 
 	* vm.c (Init_BareVM): call Init_native_thread here.
diff --git a/array.c b/array.c
index b7ee2f8833..35335f5437 100644
--- a/array.c
+++ b/array.c
@@ -4306,6 +4306,7 @@ rb_ary_product(int argc, VALUE *argv, VALUE ary)
     RBASIC(t1)->klass = 0;
 
     /* initialize the arrays of arrays */
+    ARY_SET_LEN(t0, n);
     arrays[0] = ary;
     for (i = 1; i < n; i++) arrays[i] = to_ary(argv[i-1]);
 
diff --git a/test/ruby/envutil.rb b/test/ruby/envutil.rb
index 1839ed6da5..1824e548ed 100644
--- a/test/ruby/envutil.rb
+++ b/test/ruby/envutil.rb
@@ -130,6 +130,14 @@ module EnvUtil
     return stderr
   end
   module_function :verbose_warning
+
+  def under_gc_stress
+    stress, GC.stress = GC.stress, true
+    yield
+  ensure
+    GC.stress = stress
+  end
+  module_function :under_gc_stress
 end
 
 module Test
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index fedcec71fc..0ee38a2b37 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1,4 +1,5 @@
 require 'test/unit'
+require_relative 'envutil'
 
 class TestArray < Test::Unit::TestCase
   def setup
@@ -1515,6 +1516,13 @@ class TestArray < Test::Unit::TestCase
                  @cls[1,2].product([3,4],[5,6]))
     assert_equal(@cls[[1],[2]], @cls[1,2].product)
     assert_equal(@cls[], @cls[1,2].product([]))
+
+    bug3394 = '[ruby-dev:41540]'
+    acc = []
+    EnvUtil.under_gc_stress {[1,2].product([3,4,5],[6,8]){|array| acc << array}}
+    assert_equal([[1, 3, 6], [1, 3, 8], [1, 4, 6], [1, 4, 8], [1, 5, 6], [1, 5, 8],
+                  [2, 3, 6], [2, 3, 8], [2, 4, 6], [2, 4, 8], [2, 5, 6], [2, 5, 8]],
+                 acc, bug3394)
   end
 
   def test_permutation