ko1	2018-12-23 23:58:41 +0900 (Sun, 23 Dec 2018)

  New Revision: 66513

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=66513

  Log:
    fix marking T_NONE object bug.
    
    * array.c (rb_ary_splice): do not use RARRAY_PTR() here because it can cause
      GC because of rb_ary_detransient(). Here ary can contain T_NONE object
      because of increasing capacity and not initialized yet.
    
      error log: http://ci.rvm.jp/results/trunk-test@ruby-sky1/1557174

  Modified files:
    trunk/array.c
Index: array.c
===================================================================
--- array.c	(revision 66512)
+++ array.c	(revision 66513)
@@ -1868,7 +1868,13 @@ rb_ary_splice(VALUE ary, long beg, long https://github.com/ruby/ruby/blob/trunk/array.c#L1868
 	if (rlen > 0) {
             if (rofs != -1) rptr = RARRAY_CONST_PTR_TRANSIENT(ary) + rofs;
             /* give up wb-protected ary */
-	    MEMMOVE(RARRAY_PTR(ary) + beg, rptr, VALUE, rlen);
+            RB_OBJ_WB_UNPROTECT_FOR(ARRAY, ary);
+
+            /* do not use RARRAY_PTR() because it can causes GC.
+             * ary can contain T_NONE object because it is not cleared.
+             */
+            RARRAY_PTR_USE_TRANSIENT(ary, ptr,
+                                     MEMMOVE(ptr + beg, rptr, VALUE, rlen));
 	}
     }
 }

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/