When GC occurs during the expansion of the GC arena by `gc_protect()` in `mrb_obj_alloc()`, the object page just allocated by `add_heap()` is released.
Therefore, as soon as control returns from `gc_protect()`, there is a possibility of illegal writing or reading to the address just released.
This issue was discovered during the investigation of mruby#6326.

dearblue added a commit to dearblue/mruby that referenced this pull request

This was the unintentional catalyst for finding the problem in mruby#6329, but it is preferable to add a test if necessary.

Merged

matz added a commit that referenced this pull request

matz added a commit that referenced this pull request

We assumed there's no need for gc_arena_keep() when MRB_GC_FIXED_ARENA
is set.  But it turned out that gc_protect() still can cause use-after-free
with fixed arena.
Revert "gc.c (gc_protect): should not call gc_arena_keep twice from allocation"
This reverts commit  28ece4e .
Revert "gc.c (gc_arena_keep): reorganized for MRB_GC_FIXED_ARENA; ref #6329"
This reverts commit  33dd623 .