diff --git a/ChangeLog b/ChangeLog
index 885431d5a6..e0a9a03ce7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed Oct 11 16:57:46 2006  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* array.c (rb_ary_replace): should shift lfree pointer before
+	  calling xfree.
+
 Wed Oct 11 15:07:42 2006  Akinori MUSHA  <knu@iDaemons.org>
 
 	* ext/digest/lib/digest/hmac.rb: Add digest/hmac, which implements
diff --git a/array.c b/array.c
index e488b556d2..d4957a95b3 100644
--- a/array.c
+++ b/array.c
@@ -2158,7 +2158,11 @@ rb_ary_replace(VALUE copy, VALUE orig)
 	ARY_SET_NOEMBED(copy);
     }
     else {
-	xfree(RARRAY(copy)->as.heap.ptr);
+	VALUE *ptr = RARRAY(copy)->as.heap.ptr;
+	if (ARY_LFREE_P(copy)) {
+	    ptr -= LFREE_SIZE(copy);
+	}
+	xfree(ptr);
     }
     RARRAY(copy)->as.heap.ptr = RARRAY(shared)->as.heap.ptr;
     RARRAY(copy)->as.heap.len = RARRAY(shared)->as.heap.len;