Handle mutating of array passed to Set.new during iteration

This avoids a heap-use-after-free.

Fixes [Bug #21306]

Author: jeremyevans

set.c

@@ -494,18 +494,13 @@ set_i_initialize(int argc, VALUE *argv, VALUE set)
 
     if (argc > 0 && (other = argv[0]) != Qnil) {
         if (RB_TYPE_P(other, T_ARRAY)) {
-            long len = RARRAY_LEN(other);
-            if (RARRAY_LEN(other) != 0) {
-                set_table *into = RSET_TABLE(set);
-                VALUE key;
-                int block_given = rb_block_given_p();
-                RARRAY_PTR_USE(other, ptr, {
-                    for(; len > 0; len--, ptr++) {
-                        key = *ptr;
-                        if (block_given) key = rb_yield(key);
-                        set_table_insert_wb(into, set, key, NULL);
-                    }
-                });
+            long i;
+            int block_given = rb_block_given_p();
+            set_table *into = RSET_TABLE(set);
+            for (i=0; i<RARRAY_LEN(other); i++) {
+                VALUE key = RARRAY_AREF(other, i);
+                if (block_given) key = rb_yield(key);
+                set_table_insert_wb(into, set, key, NULL);
             }
         }
         else {

test/ruby/test_set.rb

@@ -643,6 +643,11 @@ def test_merge_mutating_hash_bug_21305
     assert_equal([o], Set.new.merge(a).to_a)
   end
 
+  def test_initialize_mutating_array_bug_21306
+    a = (1..100).to_a
+    assert_equal(Set[0], Set.new(a){a.clear; 0})
+  end
+
   def test_subtract
     set = Set[1,2,3]