`a[range] = a` on a long-enough array tripped a heap-buffer-overflow
in value_move(). mrb_ary_splice's self-aset branch calls ary_dup(a)
to get an independent copy of the source elements, but ary_dup ->
ary_replace converts the source to shared as a copy-on-write
optimization when the length exceeds ARY_REPLACE_SHARED_MIN. After
that, a->as.heap.aux is reinterpreted as `shared` (the union member)
and ARY_CAPA(a) reads from the shared pointer's bits rather than
the real capacity. The expand-capa check below then silently mis-
sizes and value_move walks past the buffer.
Re-modify `a` immediately after ary_dup to un-share before the in-
place mutation. The buffer reads through `argv` (which now points
into the dup's storage) stay valid because ary_modify on a multi-
reference shared array allocates a fresh buffer for `a` and leaves
the original buffer owned by the dup.
Found via clusterfuzz mruby_fuzzer testcase 6525563811725312;
regression test covers a[3, 2] = a on a 31-element array (above
the ARY_REPLACE_SHARED_MIN=20 threshold).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Modify `Enumerable#hash` to use `__method_recursive?(:hash)` for recursion
detection, preventing infinite loops when hashing self-referencing enumerables.
Add a test case to verify the fix.
Co-authored-by: Gemini <gemini@google.com>
CRuby 3.4 puts spaces around `=>` since for example `{:a!=>2}` can be
confusing where to separate tokens. mruby should follow the behavior.
Many tests in `test/t` directory assumed no spaces around `=>`, so we
needed to fix them too.
## Summary
This following is a behavior from CRuby 1.8.7 to 3.1.0.
```console
% ruby -ve "p ['a', 'b', 'c']*''"
ruby 1.8.7 (2013-12-22 patchlevel 375) [i686-darwin13.0.2]
"abc"
% ruby -ve "p ['a', 'b', 'c']*''"
ruby 3.1.0p0 (2021-12-25 revision fb4df44d16) [x86_64-darwin19]
"abc"
```
### Before (mruby 3.0.0)
mruby unexpectedly gives the TypeError.
```ruby
['a', 'b', 'c']*'' #=> String cannot be converted to Integer (TypeError)
```
### After
This PR makes mruby behave compatible with CRuby.
```ruby
['a', 'b', 'c']*'' #=> 'abc'
```
As far as I checked, the behavior is unspecified when `Array#*`'s argument
is not an instance of Integer class in X 3017 : 2013 (ISO/IEC 30170 : 2012).
## Additional Information
I noticed this difference by the following idiom when writing ASCII art code
using Ruby.
```ruby
%w(foo bar baz)*''
```
e.g. TRICK (https://github.com/tric)
- Integrate `Fixnum` and `Integer`
- Remove `Integral`
- `int / int -> int`
- Replace `mrb_fixnum()` to `mrb_int()`
- Replace `mrb_fixnum_value()` to `mrb_int_value()`.
- Use `mrb_integer_p()` instead of `mrb_fixnum_p()`
Yukihiro "Matz" Matsumoto