mruby-compiler: fix sp imbalance in pattern matching with rescue

The => pattern matching codegen was doing push() after RAISEIF, even though
RAISEIF never returns. This caused sp to be off by 1 when success and failure
paths joined, resulting in wrong register allocation for subsequent operations.

For string interpolation like "#{ expr => pattern rescue body }", the base
string would be at R2 but STRCAT would incorrectly use R3, causing memory
corruption and crashes.

Test case: %{#{.=>.,. rescue def .()end}} (from oss-fuzz)

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-03 20:21:44 +09:00
parent a9825e92df
commit af3f9b65f1
+1 -1
View File
@@ -6655,7 +6655,7 @@ codegen(codegen_scope *s, node *tree, int val)
genop_3(s, OP_SEND, exc_reg, sym_idx(s, MRB_SYM_2(s->mrb, new)), 1);
/* Raise the exception */
genop_1(s, OP_RAISEIF, exc_reg);
if (val) push();
/* No push here: RAISEIF never returns, control transfers to rescue handler */
}
else {
/* expr in pattern: return false */