Recheck elements type after `to_str` conversion

https://hackerone.com/reports/244786

array.c

@@ -2286,7 +2286,7 @@ recursive_join(VALUE obj, VALUE argp, int recur)
     return Qnil;
 }
 
-static void
+static long
 ary_join_0(VALUE ary, VALUE sep, long max, VALUE result)
 {
     long i;
@@ -2295,10 +2295,12 @@ ary_join_0(VALUE ary, VALUE sep, long max, VALUE result)
     if (max > 0) rb_enc_copy(result, RARRAY_AREF(ary, 0));
     for (i=0; i<max; i++) {
 	val = RARRAY_AREF(ary, i);
+        if (!RB_TYPE_P(val, T_STRING)) break;
 	if (i > 0 && !NIL_P(sep))
 	    rb_str_buf_append(result, sep);
 	rb_str_buf_append(result, val);
     }
+    return i;
 }
 
 static void
@@ -2374,7 +2376,7 @@ rb_ary_join(VALUE ary, VALUE sep)
 	    int first;
 	    result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10);
 	    rb_enc_associate(result, rb_usascii_encoding());
-	    ary_join_0(ary, sep, i, result);
+            i = ary_join_0(ary, sep, i, result);
 	    first = i == 0;
 	    ary_join_1(ary, ary, sep, i, result, &first);
 	    return result;

test/ruby/test_array.rb

@@ -2447,6 +2447,16 @@ class TestArray < Test::Unit::TestCase
     assert_equal("12345", [1,[2,[3,4],5]].join)
   end
 
+  def test_join_recheck_elements_type
+    x = Struct.new(:ary).new
+    def x.to_str
+      ary[2] = [0, 1, 2]
+      "z"
+    end
+    (x.ary = ["a", "b", "c", x])
+    assert_equal("ab012z", x.ary.join(""))
+  end
+
   def test_to_a2
     klass = Class.new(Array)
     a = klass.new.to_a