From 787487b16dce4fbb9059a70b13d31d8be679fe70 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Fri, 19 Feb 2021 15:36:41 +0900
Subject: Check `MRB_TT_*` before object allocation; ref #5352

---
 include/mruby/value.h | 6 +++---
 src/gc.c              | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/mruby/value.h b/include/mruby/value.h
index 293ef90a7..a73803a14 100644
--- a/include/mruby/value.h
+++ b/include/mruby/value.h
@@ -107,12 +107,12 @@ static const unsigned int IEEE754_INFINITY_BITS_SINGLE = 0x7F800000;
 enum mrb_vtype {
   MRB_TT_FALSE = 0,
   MRB_TT_TRUE,
-  MRB_TT_FLOAT,
-  MRB_TT_INTEGER,
   MRB_TT_SYMBOL,
   MRB_TT_UNDEF,
-  MRB_TT_CPTR,
   MRB_TT_FREE,
+  MRB_TT_FLOAT,
+  MRB_TT_INTEGER,
+  MRB_TT_CPTR,
   MRB_TT_OBJECT,
   MRB_TT_CLASS,
   MRB_TT_MODULE,
diff --git a/src/gc.c b/src/gc.c
index 98a2237d5..07ca61e52 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -559,6 +559,9 @@ mrb_obj_alloc(mrb_state *mrb, enum mrb_vtype ttype, struct RClass *cls)
       mrb_raisef(mrb, E_TYPE_ERROR, "allocation failure of %C", cls);
     }
   }
+  if (ttype <= MRB_TT_FREE) {
+    mrb_raisef(mrb, E_TYPE_ERROR, "allocation failure of %C (type %d)", cls, (int)ttype);
+  }
 
 #ifdef MRB_GC_STRESS
   mrb_full_gc(mrb);
-- 
cgit v1.2.3