From c033dc3073839e3578f1ba25d53b837974b56474 Mon Sep 17 00:00:00 2001
From: Luke Gruber <luke.gru@gmail.com>
Date: Sat, 22 Jun 2019 11:25:52 -0400
Subject: [PATCH] Fix issue with Array#rindex when rb_equal modifies receiver
 array

Fixes [Bug #15951]

Closes: https://github.com/ruby/ruby/pull/2250
---
 array.c                 |  3 +++
 test/ruby/test_array.rb | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/array.c b/array.c
index de2f80828a..8501074ebe 100644
--- a/array.c
+++ b/array.c
@@ -1805,6 +1805,9 @@ rb_ary_rindex(int argc, VALUE *argv, VALUE ary)
 	if (rb_equal(e, val)) {
 	    return LONG2NUM(i);
 	}
+        if (i > RARRAY_LEN(ary)) {
+            break;
+        }
     }
     return Qnil;
 }
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index df9f08a26d..88d61b79e0 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1438,6 +1438,16 @@ class TestArray < Test::Unit::TestCase
     assert_nil(a.rindex([1,2]))
 
     assert_equal(3, a.rindex(99) {|x| x == [1,2,3] })
+
+    bug15951 = "[Bug #15951]"
+    o2 = Object.new
+    def o2.==(other)
+      other.replace([]) if Array === other
+      false
+    end
+    a = Array.new(10)
+    a.fill(o2)
+    assert_nil(a.rindex(a), bug15951)
   end
 
   def test_shift