mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
eea9e30979
The JMPNOT-to-JMPIF optimization in NODE_PAT_ALT assumed the fail chain always ends with OP_JMPNOT (format BS), but NODE_PAT_PIN generates OP_JMP (format S) when the pinned variable is undefined. Writing OP_JMPIF at left_fail-2 then corrupts the preceding instruction's operand, causing out-of-bounds pool access at runtime. Co-authored-by: Claude <noreply@anthropic.com>