Avoid crashing of `Array#unshift`; fix #4808

On cases like `a.unshift(*a)`.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/array.c b/src/array.c
index 85481fe9e..8190c2416 100644
--- a/src/array.c
+++ b/src/array.c
@@ -631,11 +631,13 @@ mrb_ary_unshift_m(mrb_state *mrb, mrb_value self)
     ptr = a->as.heap.ptr;
   }
   else {
+    mrb_bool same = vals == ARY_PTR(a);
     ary_modify(mrb, a);
     if (ARY_CAPA(a) < len + alen)
       ary_expand_capa(mrb, a, len + alen);
     ptr = ARY_PTR(a);
     value_move(ptr + alen, ptr, len);
+    if (same) vals = ptr;
   }
   array_copy(ptr, vals, alen);
   ARY_SET_LEN(a, len+alen);