Guard against oob read in rb_ary_aref1

When the array is shrunk during rb_arithmetic_sequence_beg_len_step,
ary_subseq_len returns -1. Return an empty array instead of passing the
negative length to ary_make_partial or ary_make_partial_step.

[Bug #22325]

Author: eightbitraptor

array.c

@@ -1943,7 +1943,7 @@ rb_ary_aref1(VALUE ary, VALUE arg)
       default:
         if (step == 0) rb_raise(rb_eArgError, "slice step cannot be zero");
         len = ary_subseq_len(ary, beg, len);
-        if (len == 0) return ary_new(klass, 0);
+        if (len <= 0) return ary_new(klass, 0);
         if (step == 1) return ary_make_partial(ary, klass, beg, len);
         return ary_make_partial_step(ary, klass, beg, len, step);
     }

test/ruby/test_array.rb

@@ -1833,6 +1833,33 @@ def test_slice_out_of_range
     assert_equal([100], a.slice(-1, 1_000_000_000))
   end
 
+  def test_slice_shrinking_array_by_to_int
+    bug22325 = '[Bug #22325]'
+    cls = Class.new(Numeric) do
+      attr_reader :val
+      def initialize(ary, val)
+        @ary = ary
+        @val = val
+      end
+      def <=>(other)
+        val <=> (other.is_a?(self.class) ? other.val : other)
+      end
+      def to_int
+        @ary.clear
+        val
+      end
+      def coerce(other)
+        [other, val]
+      end
+    end
+
+    ary = @cls[*(1..100).to_a]
+    assert_equal([], ary[Range.new(cls.new(ary, 50), cls.new(ary, 60))], bug22325)
+
+    ary.replace((1..100).to_a)
+    assert_equal([], ary[Range.new(cls.new(ary, 50), cls.new(ary, 60)).step(2)], bug22325)
+  end
+
   def test_slice_gc_compact_stress
     EnvUtil.under_gc_compact_stress { assert_equal([1, 2, 3, 4, 5], (0..10).to_a[1, 5]) }
     EnvUtil.under_gc_compact_stress do