The key or value object could be reclaimed by GC; fix
The GC may occur between `sg_shift` and `mrb_assoc_new`, in which
case `key` and `value` could be freed even tough they are still alive.
The issue is found and fixed by
MODIFY
src/hash.c
src/hash.c
@@ -1057,6 +1057,8 @@ mrb_hash_shift(mrb_state *mrb, mrb_value hash)
mrb_value del_key, del_val;
sg_shift(mrb, sg, &del_key, &del_val);
+ mrb_gc_protect(mrb, del_key);
+ mrb_gc_protect(mrb, del_val);
return mrb_assoc_new(mrb, del_key, del_val);
}

The key or value object could be reclaimed by GC; fix #4164

The GC may occur between `sg_shift` and `mrb_assoc_new`, in which
case `key` and `value` could be freed even tough they are still alive.

The issue is found and fixed by https://hackerone.com/hexodus