From bbbb3221765b88117e61ec155cd2fa80e7ed0a06 Mon Sep 17 00:00:00 2001
From: Jeremy Evans <code@jeremyevans.net>
Date: Tue, 18 Jun 2019 18:59:49 -0700
Subject: [PATCH] Make String#-@ not freeze receiver if called on unfrozen
 subclass instance

rb_fstring behavior in this case is to freeze the receiver.  I'm
not sure if that should be changed, so this takes the conservative
approach of duping the receiver in String#-@ before passing
to rb_fstring.

Fixes [Bug #15926]
---
 string.c                 |  3 +++
 test/ruby/test_string.rb | 16 ++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/string.c b/string.c
index 3feeb8c705..ec81cb13f0 100644
--- a/string.c
+++ b/string.c
@@ -2655,6 +2655,9 @@ str_uplus(VALUE str)
 static VALUE
 str_uminus(VALUE str)
 {
+    if (!BARE_STRING_P(str) && !rb_obj_frozen_p(str)) {
+        str = rb_str_dup(str);
+    }
     return rb_fstring(str);
 }
 
diff --git a/test/ruby/test_string.rb b/test/ruby/test_string.rb
index afa3803023..d8b4d6a5f7 100644
--- a/test/ruby/test_string.rb
+++ b/test/ruby/test_string.rb
@@ -3168,6 +3168,22 @@ def test_uplus_minus
     assert_same(str, -bar, "uminus deduplicates [Feature #13077]")
   end
 
+  def test_uminus_no_freeze_not_bare
+    str = @cls.new("foo")
+    -str
+    assert_equal(false, str.frozen?)
+
+    str = @cls.new("foo")
+    str.instance_variable_set(:@iv, 1)
+    -str
+    assert_equal(false, str.frozen?)
+
+    str = @cls.new("foo")
+    str.taint
+    -str
+    assert_equal(false, str.frozen?)
+  end
+
   def test_ord
     assert_equal(97, "a".ord)
     assert_equal(97, "abc".ord)
-- 
2.21.0