fix marking T_NONE object bug.

* array.c (rb_ary_splice): do not use RARRAY_PTR() here because it can cause
  GC because of rb_ary_detransient(). Here ary can contain T_NONE object
  because of increasing capacity and not initialized yet.

  error log: http://ci.rvm.jp/results/trunk-test@ruby-sky1/1557174


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66513 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

array.c

@@ -1868,7 +1868,13 @@ rb_ary_splice(VALUE ary, long beg, long len, const VALUE *rptr, long rlen)
 	if (rlen > 0) {
             if (rofs != -1) rptr = RARRAY_CONST_PTR_TRANSIENT(ary) + rofs;
             /* give up wb-protected ary */
-	    MEMMOVE(RARRAY_PTR(ary) + beg, rptr, VALUE, rlen);
+            RB_OBJ_WB_UNPROTECT_FOR(ARRAY, ary);
+
+            /* do not use RARRAY_PTR() because it can causes GC.
+             * ary can contain T_NONE object because it is not cleared.
+             */
+            RARRAY_PTR_USE_TRANSIENT(ary, ptr,
+                                     MEMMOVE(ptr + beg, rptr, VALUE, rlen));
 	}
     }
 }