Fixed UPVAR gotchas; fix #3835

Both `uvenv` function and `env` generation in `create_proc_from_string`
function have bugs to handling enclosed environment objects.

src/vm.c

@@ -217,13 +217,24 @@ uvenv(mrb_state *mrb, int up)
   struct RProc *proc = mrb->c->ci->proc;
   struct REnv *e;
 
-  do {
-    e = MRB_PROC_ENV(proc);
-    if (!e) return NULL;
+  while (up--) {
     proc = proc->upper;
     if (!proc) return NULL;
-  } while (up--);
-  return e;
+  }
+  e = MRB_PROC_ENV(proc);
+  if (e) return e;              /* proc has enclosed env */
+  else {
+    mrb_callinfo *ci = mrb->c->ci;
+    mrb_callinfo *cb = mrb->c->cibase;
+
+    while (cb <= ci) {
+      if (ci->proc == proc) {
+        return ci->env;
+      }
+      ci--;
+    }
+  }
+  return NULL;
 }
 
 static inline struct RProc*