merge revision(s) 51263,51264: [Backport #11352]

	* vm.c (m_core_hash_merge_ptr): copy the arguments to the machine
	  stack before rewinding the control frame pointer and leaving the
	  arguments outside valid region of the value stack.
	  [ruby-core:69969] [Bug #11352]

	* vm.c (REWIND_CFP): keep the arguments region inside the valid
	  value stack.  [ruby-core:69969] [Bug #11352]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_1@51601 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

4 files changed, 31 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 0109a906ed..a36c5f4b72 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+Mon Aug 17 16:46:28 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* vm.c (m_core_hash_merge_ptr): copy the arguments to the machine
+	  stack before rewinding the control frame pointer and leaving the
+	  arguments outside valid region of the value stack.
+	  [ruby-core:69969] [Bug #11352]
+
+	* vm.c (REWIND_CFP): keep the arguments region inside the valid
+	  value stack.  [ruby-core:69969] [Bug #11352]
+
 Mon Aug 17 16:44:01 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* string.c (rb_str_reverse): reversed string is not a substring,
diff --git a/test/ruby/test_literal.rb b/test/ruby/test_literal.rb
index 5fa326acfe..6e5d41477e 100644
--- a/test/ruby/test_literal.rb
+++ b/test/ruby/test_literal.rb
@@ -193,7 +193,9 @@ class TestRubyLiteral < Test::Unit::TestCase
     assert_normal_exit %q{GC.disable=true; x = nil; raise if eval("[#{(1..1_000_000).to_a.join(", ")}]").size != 1_000_000}, "", timeout: 300, child_env: %[--disable-gems]
     assert_normal_exit %q{GC.disable=true; x = nil; raise if eval("{#{(1..1_000_000).map{|n| "#{n} => x"}.join(', ')}}").size != 1_000_000}, "", timeout: 300, child_env: %[--disable-gems]
     assert_normal_exit %q{GC.disable=true; x = nil; raise if eval("{#{(1..1_000_000).map{|n| "#{n} => #{n}"}.join(', ')}}").size != 1_000_000}, "", timeout: 300, child_env: %[--disable-gems]
+  end
 
+  def test_big_hash_literal
     bug7466 = '[ruby-dev:46658]'
     h = {
       0xFE042 => 0xE5CD,
@@ -328,6 +330,19 @@ class TestRubyLiteral < Test::Unit::TestCase
     }
     k = h.keys
     assert_equal([129, 0xFE331], [k.size, k.last], bug7466)
+
+    code = [
+      "h = {",
+      (1..128).map {|i| "#{i} => 0,"},
+      (129..140).map {|i| "#{i} => [],"},
+      "}",
+    ].join
+    assert_separately([], <<-"end;")
+      GC.stress = true
+      #{code}
+      GC.stress = false
+      assert_equal(140, h.size)
+    end;
   end
 
   def test_range
diff --git a/version.h b/version.h
index 37a75a7188..490bf22422 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.1.7"
 #define RUBY_RELEASE_DATE "2015-08-17"
-#define RUBY_PATCHLEVEL 384
+#define RUBY_PATCHLEVEL 385
 
 #define RUBY_RELEASE_YEAR 2015
 #define RUBY_RELEASE_MONTH 8
diff --git a/vm.c b/vm.c
index e712788054..8f3ac5e7c0 100644
--- a/vm.c
+++ b/vm.c
@@ -2269,7 +2269,11 @@ vm_define_method(rb_thread_t *th, VALUE obj, ID id, VALUE iseqval,
 
 #define REWIND_CFP(expr) do { \
     rb_thread_t *th__ = GET_THREAD(); \
-    th__->cfp++; expr; th__->cfp--; \
+    VALUE *const curr_sp = (th__->cfp++)->sp; \
+    VALUE *const saved_sp = th__->cfp->sp; \
+    th__->cfp->sp = curr_sp; \
+    expr; \
+    (th__->cfp--)->sp = saved_sp; \
 } while (0)
 
 static VALUE