Fixed heap-use-after-free
	
	* string.c (rb_str_sub_bang): retrieves a pointer to the
	  replacement string buffer just before using it, for the case of
	  replacement with the receiver string itself.  [Bug #16105]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67773 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	Preserve the string content at self-copying
	
	* string.c (rb_str_init): preserve the embedded content when
	  self-copying with a capacity.  [Bug #15937]
	
	New buffer for shared string
	
	* string.c (rb_str_init): allocate new buffer if the string is
	  shared.  [Bug #15937]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67769 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	String#b: Don't depend on dependent string
	
	Registering a string that depend on a dependent string as fstring
	can lead to use-after-free. See c06ddfe and 3f95620 for details.
	
	The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
	and 2.6.3. Credits to @wanabe for using eval as a cross-version way
	of registering a fstring.
	
	```ruby
	a = ('j' * 24).b.b
	eval('', binding, a)
	
	p a
	4.times { GC.start }
	p a
	```

	- string.c (str_replace_shared_without_enc): when given a
	  dependent string, depend on the root of the dependent
	  string.
	
	[Bug #15934]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67767 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	Get rid of indirect sharing

	* string.c (str_duplicate): share the root shared string if the
	  original string is already sharing, so that all shared strings
	  refer the root shared string directly.  indirect sharing can
	  cause a dangling pointer.

	[Bug #15792]

	str_duplicate: Don't share with a frozen shared string

	This is a follow up for 3f9562015e651735bfc2fdd14e8f6963b673e22a.
	Before this commit, it was possible to create a shared string which
	shares with another shared string by passing a frozen shared string
	to `str_duplicate`.

	Such string looks like:

	```
	 --------                    -----------------
	 | root | ------ owns -----> | root's buffer |
	 --------                    -----------------
	     ^                             ^   ^
	 -----------                       |   |
	 | shared1 | ------ references -----   |
	 -----------                           |
	     ^                                 |
	 -----------                           |
	 | shared2 | ------ references ---------
	 -----------
	```

	This is bad news because `rb_fstring(shared2)` can make `shared1`
	independent, which severs the reference from `shared1` to `root`:

	```c
	/* from fstr_update_callback() */
	str = str_new_frozen(rb_cString, shared2);  /* can return shared1 */
	if (STR_SHARED_P(str)) { /* shared1 is also a shared string */
	    str_make_independent(str);  /* no frozen check */
	}
	```

	If `shared1` was the only reference to `root`, then `root` can be
	reclaimed by the GC, leaving `shared2` in a corrupted state:

	```
	 -----------                         --------------------
	 | shared1 | -------- owns --------> | shared1's buffer |
	 -----------                         --------------------
	      ^
	      |
	 -----------                         -------------------------
	 | shared2 | ------ references ----> | root's buffer (freed) |
	 -----------                         -------------------------
	```

	Here is a reproduction script for the situation this commit fixes.

	```ruby
	a = ('a' * 24).strip.freeze.strip
	-a
	p a
	4.times { GC.start }
	p a
	```

	 - string.c (str_duplicate): always share with the root string when
	   the original is a shared string.
	 - test_rb_str_dup.rb: specifically test `rb_str_dup` to make
	   sure it does not try to share with a shared string.

	[Bug #15792]

	Closes: https://github.com/ruby/ruby/pull/2159

	Update dependencies


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67766 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	Don't use single byte optimization on grapheme clusters

	Unicode Text Segmentation considers CRLF as a character. [Bug #15337]

	add tests using Unicode test data for grapheme clusters

	Add file test/ruby/enc/test_grapheme_breaks.rb to test String#each_grapheme_cluster
	and \X extended grapheme cluster matcher in regular expressions against test data
	provided by Unicode (ucd/auxiliary/GraphemeBreakTest.txt).

	Some lines in the data file are ignored, as follows:
	- Lines with a surrogate, because Ruby doesn't handle these
	- The case of "\r\n", because there is a bug (#15337) in the implementation

	remove guard against bug #15337, because it is fixed

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@66073 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	string.c: fix scanned substring with `\K`

	* string.c (scan_once): fix the matched substring with `\K`, the
	  beginning of that string may differ from the matched position.
	  [ruby-core:86663] [Bug #14707]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64320 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	fix each_grapheme_cluster's size [Bug #14363]

	From: Hugo Peixoto <hugo.peixoto@gmail.com>

	Factor out get_reg_grapheme_cluster

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62896 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	string.c: clear substring code range

	* string.c (str_substr): substring of broken code range string may
	  be valid or broken.  patch by tommy (Masahiro Tomita) at
	  [ruby-dev:50430] [Bug #14388].

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62483 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	string.c: chomp rs at the end

	* string.c (rb_str_enumerate_lines): should chomp record separator
	  only, but not a newline, at the end of the receiver as well as
	  middle, if the separator is given.
	  [ruby-core:84552] [Bug #14257]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@61628 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61381 b2dd03c8-39d4-4d8f-98ff-823fe69b080e