From a763e3460f594f60a5d2e8eba5f7da981d717a55 Mon Sep 17 00:00:00 2001
From: ko1 <ko1@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Thu, 29 Nov 2018 08:03:55 +0000
Subject: clear dst Hash on Hash#replace. [Bug #15358]

* hash.c (linear_copy): solve two issues on `Hash#replace`.
  (1) fix memory leak
      (1-1) don't allocate memory if destination already
            has a memory area.
      (1-2) free destination memory if src is NULL.
  (2) clear transient heap flag if src is NULL. [Bug #15358]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66091 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 hash.c                 | 31 +++++++++++++++++++++----------
 test/ruby/test_hash.rb |  8 ++++++++
 2 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/hash.c b/hash.c
index fc30ae9cbc..ad9f495192 100644
--- a/hash.c
+++ b/hash.c
@@ -493,6 +493,7 @@ static void
 hash_array_set(VALUE hash, struct li_table *li)
 {
     HASH_ASSERT(RHASH_ARRAY_P(hash));
+    HASH_ASSERT((RHASH_TRANSIENT_P(hash) && li == NULL) ? FALSE : TRUE);
     RHASH(hash)->as.li = li;
     hash_verify(hash);
 }
@@ -993,15 +994,17 @@ linear_copy(VALUE hash1, VALUE hash2)
 {
     li_table *old_tab = RHASH_ARRAY(hash2);
 
-    if (old_tab) {
-        li_table *new_tab;
-        new_tab = (li_table*) rb_transient_heap_alloc(hash1, sizeof(li_table));
-        if (new_tab != NULL) {
-            RHASH_SET_TRANSIENT_FLAG(hash1);
-        }
-        else {
-            RHASH_UNSET_TRANSIENT_FLAG(hash1);
-            new_tab = (li_table*)ruby_xmalloc(sizeof(li_table));
+    if (old_tab != NULL) {
+        li_table *new_tab = RHASH_ARRAY(hash1);
+        if (new_tab == NULL) {
+            new_tab = (li_table*) rb_transient_heap_alloc(hash1, sizeof(li_table));
+            if (new_tab != NULL) {
+                RHASH_SET_TRANSIENT_FLAG(hash1);
+            }
+            else {
+                RHASH_UNSET_TRANSIENT_FLAG(hash1);
+                new_tab = (li_table*)ruby_xmalloc(sizeof(li_table));
+            }
         }
         *new_tab = *old_tab;
         RHASH_ARRAY_BOUND_SET(hash1, RHASH_ARRAY_BOUND(hash2));
@@ -1014,7 +1017,15 @@ linear_copy(VALUE hash1, VALUE hash2)
     else {
         RHASH_ARRAY_BOUND_SET(hash1, RHASH_ARRAY_BOUND(hash2));
         RHASH_ARRAY_SIZE_SET(hash1, RHASH_ARRAY_SIZE(hash2));
-        RHASH_ARRAY_SET(hash1, old_tab);
+
+        if (RHASH_TRANSIENT_P(hash1)) {
+            RHASH_UNSET_TRANSIENT_FLAG(hash1);
+        }
+        else if (RHASH_ARRAY(hash1)) {
+            ruby_xfree(RHASH_ARRAY(hash1));
+        }
+
+        RHASH_ARRAY_SET(hash1, NULL);
 
         rb_gc_writebarrier_remember(hash1);
         return old_tab;
diff --git a/test/ruby/test_hash.rb b/test/ruby/test_hash.rb
index 03ebd38f1f..7db3c27f87 100644
--- a/test/ruby/test_hash.rb
+++ b/test/ruby/test_hash.rb
@@ -755,6 +755,14 @@ class TestHash < Test::Unit::TestCase
     assert_predicate(h, :compare_by_identity?)
   end
 
+  def test_replace_bug15358
+    h1 = {}
+    h2 = {a:1,b:2,c:3,d:4,e:5}
+    h2.replace(h1)
+    GC.start
+    assert(true)
+  end
+
   def test_shift
     h = @h.dup
 
-- 
cgit v1.2.3