From 05f891cbbb4ee3b09e83e50924d96bddb8f67b91 Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Thu, 8 Dec 2016 06:19:06 +0000
Subject: [PATCH] vm.c: check type of hash to merge

* vm.c (core_hash_merge): check the type of the target hash to
  merge.  [ruby-core:78536] [Bug #13015]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57024 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 test/ruby/test_keyword.rb | 20 ++++++++++++++++++++
 vm.c                      |  4 +++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/test/ruby/test_keyword.rb b/test/ruby/test_keyword.rb
index bcb93a6348..ad0bf63492 100644
--- a/test/ruby/test_keyword.rb
+++ b/test/ruby/test_keyword.rb
@@ -609,4 +609,24 @@ class TestKeywordArguments < Test::Unit::TestCase
       assert_equal({x: 1, y: 2, **h}, obj.foo)
     }
   end
+
+  def test_kwrest_overwritten
+    bug13015 = '[ruby-core:78536] [Bug #13015]'
+
+    klass = EnvUtil.labeled_class("Parent") do
+      def initialize(d:)
+      end
+    end
+
+    klass = EnvUtil.labeled_class("Child", klass) do
+      def initialize(d:, **h)
+        h = [2, 3]
+        super
+      end
+    end
+
+    assert_raise_with_message(TypeError, /expected Hash/, bug13015) do
+      klass.new(d: 4)
+    end
+  end
 end
diff --git a/vm.c b/vm.c
index daa043d863..67a6e8e164 100644
--- a/vm.c
+++ b/vm.c
@@ -2600,6 +2600,7 @@ core_hash_merge(VALUE hash, long argc, const VALUE *argv)
 {
     long i;
 
+    Check_Type(hash, T_HASH);
     VM_ASSERT(argc % 2 == 0);
     for (i=0; i<argc; i+=2) {
 	rb_hash_aset(hash, argv[i], argv[i+1]);
@@ -2620,7 +2621,7 @@ core_hash_from_ary(VALUE ary)
 {
     VALUE hash = rb_hash_new();
 
-    RUBY_DTRACE_CREATE_HOOK(HASH, RARRAY_LEN(ary));
+    RUBY_DTRACE_CREATE_HOOK(HASH, (Check_Type(ary, T_ARRAY), RARRAY_LEN(ary)));
     return core_hash_merge_ary(hash, ary);
 }
 
@@ -2634,6 +2635,7 @@ m_core_hash_merge_ary(VALUE self, VALUE hash, VALUE ary)
 static VALUE
 core_hash_merge_ary(VALUE hash, VALUE ary)
 {
+    Check_Type(ary, T_ARRAY);
     core_hash_merge(hash, RARRAY_LEN(ary), RARRAY_CONST_PTR(ary));
     return hash;
 }