rhe	2016-12-20 15:53:44 +0900 (Tue, 20 Dec 2016)

  New Revision: 57121

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57121

  Log:
    array.c: do not resize to less than 0
    
    Shrinking the Array from the block invoked by Array#select! or
    Array#reject! causes the Array to be a negative number size. Ensure that
    the resulting Array won't be smaller than 0.
    [ruby-core:78739] [Bug #13053]

  Modified files:
    trunk/array.c
    trunk/test/ruby/test_array.rb
Index: test/ruby/test_array.rb
===================================================================
--- test/ruby/test_array.rb	(revision 57120)
+++ test/ruby/test_array.rb	(revision 57121)
@@ -2163,6 +2163,11 @@ class TestArray < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_array.rb#L2163
     }
     assert_equal(9, r)
     assert_equal(@cls[7, 8, 9, 10], a, bug10722)
+
+    bug13053 = '[ruby-core:78739] [Bug #13053] Array#select! can resize to negative size'
+    a = @cls[ 1, 2, 3, 4, 5 ]
+    a.select! {|i| a.clear if i == 5; false }
+    assert_equal(0, a.size, bug13053)
   end
 
   # also select!
Index: array.c
===================================================================
--- array.c	(revision 57120)
+++ array.c	(revision 57121)
@@ -2886,13 +2886,15 @@ select_bang_ensure(VALUE a) https://github.com/ruby/ruby/blob/trunk/array.c#L2886
     long len = RARRAY_LEN(ary);
     long i1 = arg->len[0], i2 = arg->len[1];
 
-    if (i2 < i1) {
+    if (i2 < len && i2 < i1) {
+	long tail = 0;
 	if (i1 < len) {
+	    tail = len - i1;
 	    RARRAY_PTR_USE(ary, ptr, {
-		    MEMMOVE(ptr + i2, ptr + i1, VALUE, len - i1);
+		    MEMMOVE(ptr + i2, ptr + i1, VALUE, tail);
 		});
 	}
-	ARY_SET_LEN(ary, len - i1 + i2);
+	ARY_SET_LEN(ary, i2 + tail);
     }
     return ary;
 }

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/