From c52faebb7f64cd0d1c51444d7bd22349dece93fa Mon Sep 17 00:00:00 2001 From: dearblue Date: Tue, 24 Mar 2026 21:25:46 +0900 Subject: [PATCH] Don't assign the result of `mrb_funcall()` directly to `regs` There are two reasons: - If the mruby call stack is extended, the `ci` variable may become invalid. - The C language does not specify the order in which the left-hand and right-hand sides of an assignment expression are evaluated. Therefore, if the mruby data stack is extended, `ci->stack` may become invalid. --- src/vm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/vm.c b/src/vm.c index 9b03789db..a1f272a52 100644 --- a/src/vm.c +++ b/src/vm.c @@ -3112,7 +3112,9 @@ RETRY_TRY_BLOCK: { \ mrb_value arg = mrb_int_value(mrb, c); \ mrb_sym mid = MRB_OPSYM(op_name); \ - regs[a] = mrb_funcall_argv(mrb, regs[a], mid, 1, &arg); \ + mrb_value v = mrb_funcall_argv(mrb, regs[a], mid, 1, &arg); \ + ci = mrb->c->ci; \ + regs[a] = v; \ mrb_gc_arena_restore(mrb, ai); \ } \ break; \