* array.c (rb_ary_replace): should shift lfree pointer before

  calling xfree.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11128 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 5 insertions, 1 deletions

diff --git a/array.c b/array.c
index e488b556d2..d4957a95b3 100644
--- a/array.c
+++ b/array.c
@@ -2158,7 +2158,11 @@ rb_ary_replace(VALUE copy, VALUE orig)
 	ARY_SET_NOEMBED(copy);
     }
     else {
-	xfree(RARRAY(copy)->as.heap.ptr);
+	VALUE *ptr = RARRAY(copy)->as.heap.ptr;
+	if (ARY_LFREE_P(copy)) {
+	    ptr -= LFREE_SIZE(copy);
+	}
+	xfree(ptr);
     }
     RARRAY(copy)->as.heap.ptr = RARRAY(shared)->as.heap.ptr;
     RARRAY(copy)->as.heap.len = RARRAY(shared)->as.heap.len;