diff --git a/ChangeLog b/ChangeLog
index 2d411873e8..3fd581aa81 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Sat Nov 21 16:38:50 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* marshal.c (marshal_dump): use normal object as the buffer so
+	  that no hidden object is exposed to ruby-level.  [ruby-dev:39744]
+
 Sat Nov 21 15:58:43 2009  NARUSE, Yui  <naruse@ruby-lang.org>
 
 	* io.c (read_all): fix: false negative invalid byte seequence
diff --git a/marshal.c b/marshal.c
index bcc8352f77..7acc495ca2 100644
--- a/marshal.c
+++ b/marshal.c
@@ -925,7 +925,7 @@ marshal_dump(int argc, VALUE *argv)
     arg->untrust = FALSE;
     arg->compat_tbl = st_init_numtable();
     arg->encodings = 0;
-    arg->str = rb_str_tmp_new(0);
+    arg->str = rb_str_buf_new(0);
     if (!NIL_P(port)) {
 	if (!rb_respond_to(port, s_write)) {
 	  type_error:
@@ -949,7 +949,6 @@ marshal_dump(int argc, VALUE *argv)
 	rb_io_write(arg->dest, arg->str);
 	rb_str_resize(arg->str, 0);
     }
-    RBASIC(arg->str)->klass = rb_cString;
     clear_dump_arg(arg);
     RB_GC_GUARD(wrapper);
 
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index df02086da8..0b37b7ab17 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -300,4 +300,14 @@ class TestMarshal < Test::Unit::TestCase
     assert(true, '[ruby-dev:39425]')
     assert_raise(StopIteration) {e.next}
   end
+
+  def test_dump_buffer
+    bug2390 = '[ruby-dev:39744]'
+    w = ""
+    def w.write(str)
+      self << str.to_s
+    end
+    Marshal.dump(Object.new, w)
+    assert_not_empty(w, bug2390)
+  end
 end