eregon	2013-07-18 20:38:01 +0900 (Thu, 18 Jul 2013)

  New Revision: 42041

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=42041

  Log:
    * array.c (rb_ary_count): check length to avoid SEGV
      while iterating. Remove other pointer loop when arg is given.
    * test/ruby/test_array.rb (test_count): add test for bug.
      [ruby-core:56072] [Bug #8654]

  Modified files:
    trunk/ChangeLog
    trunk/array.c
    trunk/test/ruby/test_array.rb

Index: array.c
===================================================================
--- array.c	(revision 42040)
+++ array.c	(revision 42041)
@@ -4174,10 +4174,9 @@ rb_ary_compact(VALUE ary) https://github.com/ruby/ruby/blob/trunk/array.c#L4174
 static VALUE
 rb_ary_count(int argc, VALUE *argv, VALUE ary)
 {
-    long n = 0;
+    long i, n = 0;
 
     if (argc == 0) {
-	long i;
 	VALUE v;
 
 	if (!rb_block_given_p())
@@ -4189,14 +4188,14 @@ rb_ary_count(int argc, VALUE *argv, VALU https://github.com/ruby/ruby/blob/trunk/array.c#L4188
 	}
     }
     else {
-	VALUE obj, *p, *pend;
+	VALUE obj;
 
 	rb_scan_args(argc, argv, "1", &obj);
 	if (rb_block_given_p()) {
 	    rb_warn("given block not used");
 	}
-	for (p = RARRAY_PTR(ary), pend = p + RARRAY_LEN(ary); p < pend; p++) {
-	    if (rb_equal(*p, obj)) n++;
+	for (i = 0; i < RARRAY_LEN(ary); i++) {
+	    if (rb_equal(RARRAY_AREF(ary, i), obj)) n++;
 	}
     }
 
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 42040)
+++ ChangeLog	(revision 42041)
@@ -1,3 +1,11 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
+Thu Jul 18 20:35:14 2013  Benoit Daloze  <eregontp@g...>
+
+	* array.c (rb_ary_count): check length to avoid SEGV
+	  while iterating. Remove other pointer loop when arg is given.
+
+	* test/ruby/test_array.rb (test_count): add test for bug.
+	  [ruby-core:56072] [Bug #8654]
+
 Thu Jul 18 18:14:36 2013  Masaki Matsushita  <glass.saga@g...>
 
 	* array.c (rb_ary_count): iterate items appropriately.
Index: test/ruby/test_array.rb
===================================================================
--- test/ruby/test_array.rb	(revision 42040)
+++ test/ruby/test_array.rb	(revision 42041)
@@ -572,6 +572,16 @@ class TestArray < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_array.rb#L572
     assert_equal(3, a.count {|x| x % 2 == 1 })
     assert_equal(2, a.count(1) {|x| x % 2 == 1 })
     assert_raise(ArgumentError) { a.count(0, 1) }
+
+    bug8654 = '[ruby-core:56072]'
+    assert_in_out_err [], <<-EOS, ["0"], [], bug8654
+      a1 = []
+      a2 = Array.new(100) { |i| i }
+      r = a2.count do |i|
+        p i
+        a2.replace(a1) if i == 0
+      end
+    EOS
   end
 
   def test_delete

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/