* string.c (str_gsub): reentrant check. [ruby-dev:24432]

* backport all SEGV bug fixes from CVS HEAD.  [ruby-dev:24536]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@7090 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 11 insertions, 11 deletions

diff --git a/array.c b/array.c
index 3fe872b855..26f56be664 100644
--- a/array.c
+++ b/array.c
@@ -1855,8 +1855,7 @@ rb_ary_delete(ary, item)
 
 	if (rb_equal(e, item)) continue;
 	if (i1 != i2) {
-	    if (RARRAY(ary)->len < i2) break;
-	    RARRAY(ary)->ptr[i2] = e;
+	    rb_ary_store(ary, i2, e);
 	}
 	i2++;
     }
@@ -1867,12 +1866,13 @@ rb_ary_delete(ary, item)
 	return Qnil;
     }
 
-    if (RARRAY(ary)->len > i2)
+    if (RARRAY(ary)->len > i2) {
 	RARRAY(ary)->len = i2;
-    if (i2 * 2 < RARRAY(ary)->aux.capa &&
+	if (i2 * 2 < RARRAY(ary)->aux.capa &&
 	    RARRAY(ary)->aux.capa > ARY_DEFAULT_SIZE) {
-	REALLOC_N(RARRAY(ary)->ptr, VALUE, i2 * 2);
-	RARRAY(ary)->aux.capa = i2 * 2;
+	    REALLOC_N(RARRAY(ary)->ptr, VALUE, i2 * 2);
+	    RARRAY(ary)->aux.capa = i2 * 2;
+	}
     }
 
     return item;
@@ -2170,8 +2170,8 @@ rb_ary_replace(copy, orig)
     shared = ary_make_shared(orig);
     if (RARRAY(copy)->ptr && !FL_TEST(copy, ELTS_SHARED))
 	free(RARRAY(copy)->ptr);
-    RARRAY(copy)->ptr = RARRAY(shared)->ptr;
-    RARRAY(copy)->len = RARRAY(shared)->len;
+    RARRAY(copy)->ptr = RARRAY(orig)->ptr;
+    RARRAY(copy)->len = RARRAY(orig)->len;
     RARRAY(copy)->aux.shared = shared;
     FL_SET(copy, ELTS_SHARED);
 
@@ -2280,7 +2280,7 @@ rb_ary_fill(argc, argv, ary)
 	VALUE v;
 	long i;
 
-	for (i=beg; i<RARRAY(ary)->len; i++) {
+	for (i=beg; i<end; i++) {
 	    v = rb_yield(LONG2NUM(i));
 	    if (i>=RARRAY(ary)->len) break;
 	    RARRAY(ary)->ptr[i] = v;
@@ -2372,7 +2372,7 @@ rb_ary_times(ary, times)
     }
 
     len = NUM2LONG(times);
-    if (len == 0) return rb_ary_new2(0);
+    if (len == 0) return ary_new(rb_obj_class(ary), 0);
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative argument");
     }
@@ -2890,7 +2890,7 @@ flatten(ary, idx, ary2, memo)
     while (i < lim) {
 	VALUE tmp;
 
-	tmp = rb_check_array_type(RARRAY(ary)->ptr[i]);
+	tmp = rb_check_array_type(rb_ary_elt(ary, i));
 	if (!NIL_P(tmp)) {
 	    n = flatten(ary, i, tmp, memo);
 	    i += n; lim += n;