Make String#-@ not freeze receiver if called on unfrozen subclass instance

rb_fstring behavior in this case is to freeze the receiver.  I'm
not sure if that should be changed, so this takes the conservative
approach of duping the receiver in String#-@ before passing
to rb_fstring.

Fixes [Bug #15926]

string.c

@@ -2658,6 +2658,9 @@ str_uplus(VALUE str)
 static VALUE
 str_uminus(VALUE str)
 {
+    if (!BARE_STRING_P(str) && !rb_obj_frozen_p(str)) {
+        str = rb_str_dup(str);
+    }
     return rb_fstring(str);
 }
 

test/ruby/test_string.rb

@@ -3175,6 +3175,22 @@ CODE
     assert_same(str, -bar, "uminus deduplicates [Feature #13077]")
   end
 
+  def test_uminus_no_freeze_not_bare
+    str = @cls.new("foo")
+    -str
+    assert_equal(false, str.frozen?)
+
+    str = @cls.new("foo")
+    str.instance_variable_set(:@iv, 1)
+    -str
+    assert_equal(false, str.frozen?)
+
+    str = @cls.new("foo")
+    str.taint
+    -str
+    assert_equal(false, str.frozen?)
+  end
+
   def test_ord
     assert_equal(97, "a".ord)
     assert_equal(97, "abc".ord)