Recheck elements type after `to_str` conversion

https://hackerone.com/reports/244786

1 files changed, 10 insertions, 0 deletions

diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index 476cf795f0..c3b842e950 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -2447,6 +2447,16 @@ class TestArray < Test::Unit::TestCase
     assert_equal("12345", [1,[2,[3,4],5]].join)
   end
 
+  def test_join_recheck_elements_type
+    x = Struct.new(:ary).new
+    def x.to_str
+      ary[2] = [0, 1, 2]
+      "z"
+    end
+    (x.ary = ["a", "b", "c", x])
+    assert_equal("ab012z", x.ary.join(""))
+  end
+
   def test_to_a2
     klass = Class.new(Array)
     a = klass.new.to_a