merge revision(s) 57121: [Backport #13053]

	array.c: do not resize to less than 0

	Shrinking the Array from the block invoked by Array#select! or
	Array#reject! causes the Array to be a negative number size. Ensure that
	the resulting Array won't be smaller than 0.
	[ruby-core:78739] [Bug #13053]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@58149 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 5 insertions, 3 deletions

diff --git a/array.c b/array.c
index 9649473f35..da38d945b1 100644
--- a/array.c
+++ b/array.c
@@ -2886,13 +2886,15 @@ select_bang_ensure(VALUE a)
     long len = RARRAY_LEN(ary);
     long i1 = arg->len[0], i2 = arg->len[1];
 
-    if (i2 < i1) {
+    if (i2 < len && i2 < i1) {
+	long tail = 0;
 	if (i1 < len) {
+	    tail = len - i1;
 	    RARRAY_PTR_USE(ary, ptr, {
-		    MEMMOVE(ptr + i2, ptr + i1, VALUE, len - i1);
+		    MEMMOVE(ptr + i2, ptr + i1, VALUE, tail);
 		});
 	}
-	ARY_SET_LEN(ary, len - i1 + i2);
+	ARY_SET_LEN(ary, i2 + tail);
     }
     return ary;
 }