https://git.ruby-lang.org/ruby.git/commit/?id=c7d668801b

From c7d668801bd27f8245a15311da4e8e859ba28dec Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@r...>
Date: Wed, 25 Mar 2020 01:23:03 +0900
Subject: Fixed crash when argument array is modified


diff --git a/dir.c b/dir.c
index ea0edf5..5013b9b 100644
--- a/dir.c
+++ b/dir.c
@@ -3096,7 +3096,7 @@ dir_s_glob(int argc, VALUE *argv, VALUE obj) https://github.com/ruby/ruby/blob/trunk/dir.c#L3096
 	ary = rb_push_glob(str, base, flags);
     }
     else {
-	VALUE v = ary;
+        VALUE v = rb_ary_replace(rb_ary_tmp_new(0), ary);
 	ary = dir_globs(RARRAY_LEN(v), RARRAY_CONST_PTR(v), base, flags);
 	RB_GC_GUARD(v);
     }
diff --git a/test/ruby/test_dir.rb b/test/ruby/test_dir.rb
index bab2330..13a0c31 100644
--- a/test/ruby/test_dir.rb
+++ b/test/ruby/test_dir.rb
@@ -517,4 +517,16 @@ class TestDir < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_dir.rb#L517
       assert_equal([*"a".."z"], list)
     end;
   end if defined?(Process::RLIMIT_NOFILE)
+
+  def test_glob_array_with_destructive_element
+    args = Array.new(100, "")
+    pat = Struct.new(:ary).new(args)
+    args.push(pat, *Array.new(100) {"."*40})
+    def pat.to_path
+      ary.clear
+      GC.start
+      ""
+    end
+    assert_empty(Dir.glob(args))
+  end
 end
-- 
cgit v0.10.2


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/