[Bug #22449] Fix out-of-bounds in Array#sample when array modified

Get the length after the conversion using `to_int` is complete.

Author: nobu

array.c

@@ -7027,8 +7027,8 @@ ary_sample(rb_execution_context_t *ec, VALUE ary, VALUE randgen, VALUE nv, VALUE
     rb_len_t rnds[numberof(idx)];
     rb_len_t memo_threshold;
 
-    len = RARRAY_LEN(ary);
     if (!to_array) {
+        len = RARRAY_LEN(ary);
         if (len < 2)
             i = 0;
         else
@@ -7038,6 +7038,7 @@ ary_sample(rb_execution_context_t *ec, VALUE ary, VALUE randgen, VALUE nv, VALUE
     }
     n = NUM2LEN(nv);
     if (n < 0) rb_raise(rb_eArgError, "negative sample number");
+    len = RARRAY_LEN(ary);
     if (n > len) n = len;
     if (n <= numberof(idx)) {
         for (i = 0; i < n; ++i) {

test/ruby/test_array.rb

@@ -3443,17 +3443,22 @@ def test_sample_modify_array_out_of_bounds
     gen = Object.new
     # 49 will be out-of-bounds when ary.replace is called
     def gen.rand(lim) = 49
-    assert_equal([], ary.sample(obj, random: gen))
+    assert_raise(RangeError) {ary.sample(obj, random: gen)}
 
     ary = (1..100).to_a
-    obj = Object.new
-    obj.define_singleton_method(:to_int) do
-      ary.replace(Array.new(10) { :x })
-      10
-    end
     gen = Object.new
-    gen.define_singleton_method(:rand) { |lim| 8 }
-    assert_equal([], ary.sample(obj, random: gen))
+    def gen.rand(lim) = lim-1
+    assert_equal((41..50).to_a.reverse, ary.sample(obj, random: gen))
+
+    ary = (1..100).to_a
+    gen = Object.new
+    gen.define_singleton_method(:rand) do |lim|
+      if (lim -= 1) <= 90
+        ary.replace((1..50).to_a)
+      end
+      lim
+    end
+    assert_equal([], ary.sample(10, random: gen))
   end
 
   def test_cycle