Fix issue with Array#rindex when rb_equal modifies receiver array

Fixes [Bug #15951]

Closes: https://github.com/ruby/ruby/pull/2250

2 files changed, 13 insertions, 0 deletions

diff --git a/array.c b/array.c
index de2f80828a..8501074ebe 100644
--- a/array.c
+++ b/array.c
@@ -1805,6 +1805,9 @@ rb_ary_rindex(int argc, VALUE *argv, VALUE ary)
 	if (rb_equal(e, val)) {
 	    return LONG2NUM(i);
 	}
+        if (i > RARRAY_LEN(ary)) {
+            break;
+        }
     }
     return Qnil;
 }
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index df9f08a26d..88d61b79e0 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1438,6 +1438,16 @@ class TestArray < Test::Unit::TestCase
     assert_nil(a.rindex([1,2]))
 
     assert_equal(3, a.rindex(99) {|x| x == [1,2,3] })
+
+    bug15951 = "[Bug #15951]"
+    o2 = Object.new
+    def o2.==(other)
+      other.replace([]) if Array === other
+      false
+    end
+    a = Array.new(10)
+    a.fill(o2)
+    assert_nil(a.rindex(a), bug15951)
   end
 
   def test_shift