Fix use-after-free in mrb_obj_alloc()

When GC occurs during the expansion of the GC arena by `gc_protect()` in `mrb_obj_alloc()`, the object page just allocated by `add_heap()` is released.
Therefore, as soon as control returns from `gc_protect()`, there is a possibility of illegal writing or reading to the address just released.

This issue was discovered during the investigation of #6326.

src/gc.c

@@ -372,7 +372,7 @@ mrb_gc_destroy(mrb_state *mrb, mrb_gc *gc)
 }
 
 static void
-gc_protect(mrb_state *mrb, mrb_gc *gc, struct RBasic *p)
+gc_arena_keep(mrb_state *mrb, mrb_gc *gc)
 {
 #ifdef MRB_GC_FIXED_ARENA
   if (gc->arena_idx >= MRB_GC_ARENA_SIZE) {
@@ -387,6 +387,16 @@ gc_protect(mrb_state *mrb, mrb_gc *gc, struct RBasic *p)
     gc->arena = (struct RBasic**)mrb_realloc(mrb, gc->arena, sizeof(struct RBasic*)*newcapa);
     gc->arena_capa = newcapa;
   }
+#endif
+}
+
+static inline void
+gc_protect(mrb_state *mrb, mrb_gc *gc, struct RBasic *p)
+{
+#ifdef MRB_GC_FIXED_ARENA
+  mrb_assert(gc->arena_idx < MRB_GC_ARENA_SIZE);
+#else
+  mrb_assert(gc->arena_idx < gc->arena_capa);
 #endif
   gc->arena[gc->arena_idx++] = p;
 }
@@ -398,6 +408,7 @@ mrb_gc_protect(mrb_state *mrb, mrb_value obj)
   if (mrb_immediate_p(obj)) return;
   struct RBasic *p = mrb_basic_ptr(obj);
   if (is_red(p)) return;
+  gc_arena_keep(mrb, &mrb->gc);
   gc_protect(mrb, &mrb->gc, p);
 }
 
@@ -494,6 +505,7 @@ mrb_obj_alloc(mrb_state *mrb, enum mrb_vtype ttype, struct RClass *cls)
   if (gc->threshold < gc->live) {
     mrb_incremental_gc(mrb);
   }
+  gc_arena_keep(mrb, gc);
   if (gc->free_heaps == NULL) {
     add_heap(mrb, gc);
   }