Ruby

merge revision(s) c479492a6701dcef3d3a96de8946ecf7beb079d4: [Backport #20427]

    Resize ary when `Array#sort!` block modifies embedded ary

    In cases where `rb_ary_sort_bang` is called with a block and
    tmp is an embedded array, we need to account for the block
    potentially impacting the capacity of ary.

    ex:
    ```
    var_0 = (1..70).to_a
    var_0.sort! do |var_0_block_129, var_1_block_129|
      var_0.pop
      var_1_block_129 <=> var_0_block_129
    end.shift(3)
    ```

    The above example can put the array into a corrupted state
    resulting in a heap buffer overflow and possible segfault:
    ```
    ERROR: AddressSanitizer: heap-buffer-overflow on address [...]
    WRITE of size 560 at 0x60b0000034f0 thread T0 [...]
    ```

    This commit adds a conditional to determine when the capacity
    of ary has been modified by the provided block. If this is
    the case, ensure that the capacity of ary is adjusted to
    handle at minimum the len of tmp.