From 0972c847733e774cfce92c0f2baa1b10517492a5 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Mon, 9 Sep 2024 14:57:32 +0900
Subject: [PATCH] array.c (mrb_ary_delete): protect return value; fix #6339

The C local variable is not protected from GC, so we use the function
mrb_gc_protect() to keep the value. We also keep the arena position by
mrb_gc_arena_save(), then restoring the position for every new return
value, to minimize arena size.

Small cosmetic changes (pre-increment to post-increment) are also made
in this commit.
---
 src/array.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/array.c b/src/array.c
index e82e00db1..fd1341403 100644
--- a/src/array.c
+++ b/src/array.c
@@ -1557,12 +1557,15 @@ mrb_ary_delete(mrb_state *mrb, mrb_value self)
 
   mrb_value ret = obj;
 
+  int ai = mrb_gc_arena_save(mrb);
   size_t i = 0;
   size_t j = 0;
-  for (; i < len; ++i) {
+  for (; i < len; i++) {
     mrb_value elem = val_ptr[i];
 
     if (mrb_equal(mrb, elem, obj)) {
+      mrb_gc_arena_restore(mrb, ai);
+      mrb_gc_protect(mrb, elem);
       ret = elem;
       continue;
     }
@@ -1576,7 +1579,7 @@ mrb_ary_delete(mrb_state *mrb, mrb_value self)
       val_ptr[j] = elem;
     }
 
-    ++j;
+    j++;
   }
 
   if (i == j) {