Null pointer dereference in OP_ENTER

[clayton-shopify]

The following input demonstrates a crash:

class A
  def foo
  end
end

class B < A
  def foo(*args)
    super(*args, &:b)
  end
end

B.new.foo

ASAN report:

==68149==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x0001007a4d01 bp 0x7fff5f5d0170 sp 0x7fff5f5c8660 T0)
==68149==The signal is caused by a READ memory access.
==68149==Hint: address points to the zero page.
    #0 0x1007a4d00 in mrb_vm_exec vm.c:1573
    #1 0x100792f39 in mrb_vm_run vm.c:824
    #2 0x1007c5849 in mrb_top_run vm.c:2630
    #3 0x100896845 in mrb_load_exec parse.y:5762
    #4 0x100897655 in mrb_load_file_cxt parse.y:5771
    #5 0x10062fe66 in main mruby.c:227
    #6 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

==68149==Register values:
rax = 0x0000000000000028  rbx = 0xf2f20000f2f2f200  rcx = 0x0000000000000028  rdx = 0x0000100000000005
rdi = 0x0000100000000000  rsi = 0x0000100000000000  rbp = 0x00007fff5f5d0170  rsp = 0x00007fff5f5c8660
 r8 = 0x0000100000000000   r9 = 0x0000100000000000  r10 = 0x0000000000000080  r11 = 0xffffe1d0a0a4de00
r12 = 0xf2f20000f1f1f1f1  r13 = 0x00001fffebeb9e84  r14 = 0xf2f20000f2f2f2f2  r15 = 0xf2f2f2f2f2040000
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV vm.c:1573 in mrb_vm_exec
==68149==ABORTING
Abort trap: 6

This issue was reported by Dinko Galetic & Denis Kasak (https://hackerone.com/dgaletic).