Fixed crash when argument array is modified

dir.c

@@ -3096,7 +3096,7 @@ dir_s_glob(int argc, VALUE *argv, VALUE obj)
 	ary = rb_push_glob(str, base, flags);
     }
     else {
-	VALUE v = ary;
+        VALUE v = rb_ary_replace(rb_ary_tmp_new(0), ary);
 	ary = dir_globs(RARRAY_LEN(v), RARRAY_CONST_PTR(v), base, flags);
 	RB_GC_GUARD(v);
     }

test/ruby/test_dir.rb

@@ -517,4 +517,16 @@ class TestDir < Test::Unit::TestCase
       assert_equal([*"a".."z"], list)
     end;
   end if defined?(Process::RLIMIT_NOFILE)
+
+  def test_glob_array_with_destructive_element
+    args = Array.new(100, "")
+    pat = Struct.new(:ary).new(args)
+    args.push(pat, *Array.new(100) {"."*40})
+    def pat.to_path
+      ary.clear
+      GC.start
+      ""
+    end
+    assert_empty(Dir.glob(args))
+  end
 end