merge revision(s) d43279edacd09edf3a43e02d62f5be475e7c3bcb,5dc36ddcd00fc556c04c15ce9770c5a84d7d43dc,523bf31564f160f899f8cf9f73540d6a6f687f17: [Backport #18138]

	Fix length calculation for Array#slice!

	Commit 4f24255 introduced a bug which allows a length to be passed to
	rb_ary_new4 which is too large, resulting in invalid memory access.

	For example:

	    (1..1000).to_a.slice!(-2, 1000)
	---
	 array.c | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)

	Add out of range tests for Array#slice!

	---
	 test/ruby/test_array.rb | 13 +++++++++++++
	 1 file changed, 13 insertions(+)

	Add negative position tests [Bug #18138]

	---
	 test/ruby/test_array.rb | 4 ++++
	 1 file changed, 4 insertions(+)

1 files changed, 17 insertions, 0 deletions

diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index 789531fb8c..26d40fcc6b 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1563,6 +1563,8 @@ class TestArray < Test::Unit::TestCase
 
     assert_nil(a.slice(10, -3))
     assert_equal @cls[], a.slice(10..7)
+
+    assert_equal([100], a.slice(-1, 1_000_000_000))
   end
 
   def test_slice!
@@ -1611,6 +1613,21 @@ class TestArray < Test::Unit::TestCase
     assert_raise(ArgumentError) { @cls[1].slice!(0, 0, 0) }
   end
 
+  def test_slice_out_of_range!
+    a = @cls[*(1..100).to_a]
+
+    assert_nil(a.clone.slice!(-101..-1))
+    assert_nil(a.clone.slice!(-101..))
+
+    # assert_raise_with_message(RangeError, "((-101..-1).%(2)) out of range") { a.clone.slice!((-101..-1)%2) }
+    # assert_raise_with_message(RangeError, "((-101..).%(2)) out of range") { a.clone.slice!((-101..)%2) }
+
+    assert_nil(a.clone.slice!(10, -3))
+    assert_equal @cls[], a.clone.slice!(10..7)
+
+    assert_equal([100], a.clone.slice!(-1, 1_000_000_000))
+  end
+
   def test_sort
     a = @cls[ 4, 1, 2, 3 ]
     assert_equal(@cls[1, 2, 3, 4], a.sort)