String#b: Don't depend on dependent string

Registering a string that depend on a dependent string as fstring
can lead to use-after-free. See c06ddfe and 3f95620 for details.

The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
and 2.6.3. Credits to @wanabe for using eval as a cross-version way
of registering a fstring.

```ruby
a = ('j' * 24).b.b
eval('', binding, a)

p a
4.times { GC.start }
p a
```

 - string.c (str_replace_shared_without_enc): when given a
   dependent string, depend on the root of the dependent
   string.

[Bug #15934]

1 files changed, 8 insertions, 0 deletions

diff --git a/test/ruby/test_string.rb b/test/ruby/test_string.rb
index f0649b092f..35f27c8b75 100644
--- a/test/ruby/test_string.rb
+++ b/test/ruby/test_string.rb
@@ -2983,6 +2983,14 @@ CODE
     assert_equal(('a' * 24), a, '[Bug #15792]')
   end
 
+  def test_nesting_shared_b
+    a = ('j' * 24).b.b
+    eval('', binding, a)
+    assert_equal(('j' * 24), a)
+    4.times { GC.start }
+    assert_equal(('j' * 24), a, '[Bug #15934]')
+  end
+
   def test_shared_force_encoding
     s = "\u{3066}\u{3059}\u{3068}".gsub(//, '')
     h = {}