array.c: do not resize to less than 0

Shrinking the Array from the block invoked by Array#select! or
Array#reject! causes the Array to be a negative number size. Ensure that
the resulting Array won't be smaller than 0.
[ruby-core:78739] [Bug #13053]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57121 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

array.c

@@ -2886,13 +2886,15 @@ select_bang_ensure(VALUE a)
     long len = RARRAY_LEN(ary);
     long i1 = arg->len[0], i2 = arg->len[1];
 
-    if (i2 < i1) {
+    if (i2 < len && i2 < i1) {
+	long tail = 0;
 	if (i1 < len) {
+	    tail = len - i1;
 	    RARRAY_PTR_USE(ary, ptr, {
-		    MEMMOVE(ptr + i2, ptr + i1, VALUE, len - i1);
+		    MEMMOVE(ptr + i2, ptr + i1, VALUE, tail);
 		});
 	}
-	ARY_SET_LEN(ary, len - i1 + i2);
+	ARY_SET_LEN(ary, i2 + tail);
     }
     return ary;
 }

test/ruby/test_array.rb

@@ -2163,6 +2163,11 @@ class TestArray < Test::Unit::TestCase
     }
     assert_equal(9, r)
     assert_equal(@cls[7, 8, 9, 10], a, bug10722)
+
+    bug13053 = '[ruby-core:78739] [Bug #13053] Array#select! can resize to negative size'
+    a = @cls[ 1, 2, 3, 4, 5 ]
+    a.select! {|i| a.clear if i == 5; false }
+    assert_equal(0, a.size, bug13053)
   end
 
   # also select!