vm.c: fix mark with rewinding cfp

* vm.c (m_core_hash_merge_ptr): copy the arguments to the machine
  stack before rewinding the control frame pointer and leaving the
  arguments outside valid region of the value stack.
  [ruby-core:69969] [Bug #11352]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@51263 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 9 insertions, 2 deletions

diff --git a/vm.c b/vm.c
index 797333591c..372ba8db5b 100644
--- a/vm.c
+++ b/vm.c
@@ -2400,6 +2400,7 @@ static VALUE
 core_hash_merge_ary(VALUE hash, VALUE ary)
 {
     core_hash_merge(hash, RARRAY_LEN(ary), RARRAY_CONST_PTR(ary));
+    RB_GC_GUARD(ary);
     return hash;
 }
 
@@ -2407,8 +2408,14 @@ static VALUE
 m_core_hash_merge_ptr(int argc, VALUE *argv, VALUE recv)
 {
     VALUE hash = argv[0];
-
-    REWIND_CFP(core_hash_merge(hash, argc-1, argv+1));
+    VALUE *args;
+
+    --argc; ++argv;
+    VM_ASSERT(argc <= 256);
+    args = ALLOCA_N(VALUE, argc);
+    MEMCPY(args, argv, VALUE, argc);
+    argv = args;
+    REWIND_CFP(core_hash_merge(hash, argc, argv));
 
     return hash;
 }