From af3f9b65f16f3164fa396f7d677a309b6461c12d Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 3 Jan 2026 20:21:44 +0900 Subject: [PATCH] mruby-compiler: fix sp imbalance in pattern matching with rescue The => pattern matching codegen was doing push() after RAISEIF, even though RAISEIF never returns. This caused sp to be off by 1 when success and failure paths joined, resulting in wrong register allocation for subsequent operations. For string interpolation like "#{ expr => pattern rescue body }", the base string would be at R2 but STRCAT would incorrectly use R3, causing memory corruption and crashes. Test case: %{#{.=>.,. rescue def .()end}} (from oss-fuzz) Co-authored-by: Claude --- mrbgems/mruby-compiler/core/codegen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c index 8ff2cdb65..3651d53c3 100644 --- a/mrbgems/mruby-compiler/core/codegen.c +++ b/mrbgems/mruby-compiler/core/codegen.c @@ -6655,7 +6655,7 @@ codegen(codegen_scope *s, node *tree, int val) genop_3(s, OP_SEND, exc_reg, sym_idx(s, MRB_SYM_2(s->mrb, new)), 1); /* Raise the exception */ genop_1(s, OP_RAISEIF, exc_reg); - if (val) push(); + /* No push here: RAISEIF never returns, control transfers to rescue handler */ } else { /* expr in pattern: return false */