merge revision(s) 46416: [Backport #9942]

	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
	  commented at permute0().  since `n >= r` here, buffer overflow
	  never happened, just reduce unnecessary allocation though.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47331 b2dd03c8-39d4-4d8f-98ff-823fe69b080e