rubyduino 0.2.0 → 0.2.1

data/vendor/spinel/experiments/rbs/harness.rb

@@ -0,0 +1,117 @@
+#!/usr/bin/env ruby
+# Spike harness: run spinel_analyze twice on the same AST -- once
+# without a seed file, once with -- and print the diff for the
+# Box class's @cls_meth_ptypes / @cls_meth_returns / @cls_ivar_types
+# rows. The diff is the evidence that RBS seeding flowed through to
+# the analyzer's type tables.
+#
+# Run from the spinel repo root after `make parse`:
+#
+#   ruby experiments/rbs/harness.rb
+#
+# Exit 0 = the expected diff was observed (Box#relabel's param
+# changed from int to string). Exit 1 = either the harness couldn't
+# run the pipeline or the diff didn't show the expected change.
+
+require "fileutils"
+require "tmpdir"
+
+SPINEL_ROOT = File.expand_path("../..", __dir__)
+FIXTURE_RB = File.join(__dir__, "box.rb")
+SEED_FILE  = File.join(__dir__, "box.seed")
+
+PARSE_BIN    = File.join(SPINEL_ROOT, "spinel_parse")
+ANALYZE_RB   = File.join(SPINEL_ROOT, "spinel_analyze.rb")
+
+unless File.executable?(PARSE_BIN)
+  abort "spinel_parse not built -- run `make parse` first"
+end
+
+Dir.mktmpdir("rbs_spike") do |tmp|
+  ast = File.join(tmp, "box.ast")
+  ir_off = File.join(tmp, "box_off.ir")
+  ir_on  = File.join(tmp, "box_on.ir")
+
+  ok = system(PARSE_BIN, FIXTURE_RB, ast, out: File::NULL)
+  abort "parse failed" unless ok
+
+  ok = system("ruby", ANALYZE_RB, ast, ir_off, out: File::NULL)
+  abort "analyze (no seed) failed" unless ok
+
+  ok = system("ruby", ANALYZE_RB, ast, ir_on, SEED_FILE, out: File::NULL)
+  abort "analyze (with seed) failed" unless ok
+
+  # Pluck the rows we care about. The IR format is one directive per
+  # line; rows for the class tables are positional pipes, one slot per
+  # user class. Box is the first (and only) user class in the fixture,
+  # so we read slot 0.
+  rows_of_interest = %w[
+    @cls_names
+    @cls_meth_names
+    @cls_meth_ptypes
+    @cls_meth_returns
+    @cls_ivar_names
+    @cls_ivar_types
+  ]
+
+  # IR row encoding: SA <name> <count> <row>. Within <row>, `|` is the
+  # between-class separator and any class slot's content URL-encodes
+  # its own `|`s as %7C. So per-method ptypes (separated by `|` in the
+  # raw analyzer state) become %7C in the dump, and per-param types
+  # stay comma-separated. Pluck the Box slot (index 0) and decode.
+  def pluck(path, rows)
+    out = {}
+    File.foreach(path) do |line|
+      line = line.chomp
+      next unless line.start_with?("SA ")
+      _, name, _count, rest = line.split(" ", 4)
+      rest ||= ""
+      out[name] = rest.split("|", -1)[0] if rows.include?(name)
+    end
+    out
+  end
+
+  off = pluck(ir_off, rows_of_interest)
+  on  = pluck(ir_on,  rows_of_interest)
+
+  puts "=" * 72
+  puts "Box class IR rows (slot 0 of each table; %7C is encoded |)"
+  puts "=" * 72
+  puts "%-22s  %-22s -> %-22s" % ["row", "no --rbs", "with --rbs"]
+  puts "-" * 72
+  rows_of_interest.each do |k|
+    a = off[k].to_s
+    b = on[k].to_s
+    marker = (a == b) ? "  " : "* "
+    puts "%s%-20s  %-22s -> %-22s" % [marker, k, a.inspect, b.inspect]
+  end
+  puts "=" * 72
+
+  # Box has methods (initialize, relabel, show). Within the class
+  # slot, methods are separated by %7C and params by `,`. The
+  # expected change: relabel(s)'s param flips from int to string.
+  meth_names_off  = off["@cls_meth_names"].to_s.split(";")
+  ptypes_off      = off["@cls_meth_ptypes"].to_s.split("%7C", -1)
+  ptypes_on       = on["@cls_meth_ptypes"].to_s.split("%7C", -1)
+
+  relabel_idx = meth_names_off.index("relabel")
+  if relabel_idx.nil?
+    abort "relabel not found in @cls_meth_names; fixture changed?"
+  end
+
+  before = ptypes_off[relabel_idx]
+  after  = ptypes_on[relabel_idx]
+
+  puts ""
+  puts "Box#relabel param type: #{before.inspect} -> #{after.inspect}"
+
+  if before == after
+    abort "FAIL: seeding did not change Box#relabel's param type"
+  end
+  if after != "string"
+    abort "FAIL: expected Box#relabel param to seed to 'string', got #{after.inspect}"
+  end
+
+  puts ""
+  puts "PASS: RBS seeding flowed through to the analyzer's type tables."
+end

data/vendor/spinel/lib/regexp/re_compile.c

@@ -33,20 +33,50 @@ typedef struct {
 
 static void compile_alt(re_compiler *c);  /* forward */
 
+/* Issue #781: error handler hook so the library can route through
+   the user program's sp_raise_cls (which is `static inline` per
+   translation unit and not directly linkable from a .a). The user
+   program calls sp_re_set_error_handler(fn) at startup; fn should
+   not return (typically wraps sp_raise_cls). If unset, fall back
+   to fprintf + exit. */
+static void (*sp_re_error_handler)(const char *msg) = NULL;
+void sp_re_set_error_handler(void (*fn)(const char *msg)) {
+  sp_re_error_handler = fn;
+}
+
 static void
 compile_error(re_compiler *c, const char *msg)
 {
   if (c->stripped) free(c->stripped);
   c->stripped = NULL;
-  fprintf(stderr, "RegexpError: %s: /%.*s/\n", msg, (int)(c->src_end - c->src), c->src); exit(1);
+  char buf[1024];
+  snprintf(buf, sizeof(buf), "%s: /%.*s/",
+           msg, (int)(c->src_end - c->src), c->src);
+  if (sp_re_error_handler) {
+    sp_re_error_handler(buf);
+    /* shouldn't return; fall through to exit as a safety net */
+  }
+  fprintf(stderr, "RegexpError: %s\n", buf);
+  exit(1);
 }
 
 static uint32_t
 emit(re_compiler *c, uint8_t op, uint8_t a, uint16_t offset)
 {
   if (c->code_len >= c->code_capa) {
-    c->code_capa = c->code_capa ? c->code_capa * 2 : 64;
-    c->code = (re_inst*)realloc(c->code, sizeof(re_inst) * c->code_capa);
+    /* Issue #821: detect uint32_t overflow on doubling. The previous
+       form silently wrapped to a small value (e.g. 2^31 doubles to
+       0), realloc'd a tiny buffer, then wrote past it. Cap at
+       (UINT32_MAX / 2) before doubling so the next * 2 stays in
+       range; if we're already past that, raise instead of overflowing. */
+    if (c->code_capa > (uint32_t)0x40000000u) {
+      compile_error(c, "regexp too large");
+    }
+    uint32_t new_capa = c->code_capa ? c->code_capa * 2 : 64;
+    re_inst *nc = (re_inst*)realloc(c->code, sizeof(re_inst) * new_capa);
+    if (!nc) compile_error(c, "regexp too large");
+    c->code = nc;
+    c->code_capa = new_capa;
   }
   uint32_t pos = c->code_len++;
   c->code[pos].op = op;
@@ -73,12 +103,21 @@ insert_inst(re_compiler *c, uint32_t pos, uint8_t op, uint8_t a, uint16_t offset
   c->code[pos].a = a;
   c->code[pos].offset = offset;
 
-  /* fix all jump targets that point at or past the insertion point */
+  /* Fix jump targets that point past the insertion point. An offset equal
+     to `pos` already points to the inserted instruction's new location and
+     must not be bumped -- bumping it would shift the target to whatever
+     code got displaced by the insertion (e.g. the body of the quantified
+     atom), corrupting "skip past this atom" jumps emitted earlier.
+     Imported from mruby b9b8186f00.
+     Issue #824: also patches LOOKAHEAD/NEG_LOOKAHEAD/LOOKBEHIND/
+     NEG_LOOKBEHIND (their offset is the jump-to-end target). */
   for (uint32_t i = 0; i < c->code_len; i++) {
     if (i == pos) continue;
     switch (c->code[i].op) {
     case RE_JMP: case RE_SPLIT: case RE_SPLITNG:
-      if (c->code[i].offset >= pos && c->code[i].offset < 0xffff) {
+    case RE_LOOKAHEAD: case RE_NEG_LOOKAHEAD:
+    case RE_LOOKBEHIND: case RE_NEG_LOOKBEHIND:
+      if (c->code[i].offset > pos && c->code[i].offset < 0xffff) {
         c->code[i].offset++;
       }
       break;
@@ -189,6 +228,26 @@ class_add_shorthand(re_charclass *cc, int ch)
     }
     cc->utf8_any = TRUE;
     break;
+  case 'h':
+    /* hex digit: [0-9a-fA-F] */
+    class_set_range(cc, '0', '9');
+    class_set_range(cc, 'a', 'f');
+    class_set_range(cc, 'A', 'F');
+    break;
+  case 'H':
+    /* non-hex-digit: complement of [0-9a-fA-F]. Built as an explicit
+       positive set so the top-level dispatcher can emit it as RE_CLASS
+       and the `[...]` path can add it directly -- both contexts need the
+       complement bits present (the uppercase->RE_NCLASS auto-route used
+       by \D/\W/\S is deliberately bypassed for \H). */
+    for (int i = 0; i < 128; i++) {
+      mrb_bool is_hex = (i >= '0' && i <= '9') ||
+                        (i >= 'a' && i <= 'f') ||
+                        (i >= 'A' && i <= 'F');
+      if (!is_hex) class_set_bit(cc, (uint8_t)i);
+    }
+    cc->utf8_any = TRUE;
+    break;
   }
 }
 
@@ -205,6 +264,48 @@ parse_escape(re_compiler *c)
   case 'v': return '\v';
   case 'a': return '\a';
   case 'e': return 0x1b;
+  /* `\b` is a word boundary outside a character class, but inside
+     `[...]` it means backspace (U+0008). The outer compile loop
+     consumes `\b` as RE_WBOUND before reaching parse_escape, so
+     this arm only fires from read_class_atom -- i.e. always the
+     character-class meaning. Issue #632. */
+  case 'b': return 0x08;
+  /* Octal escape `\NNN` (1-3 digits, value 0-255). The outer dispatcher
+     consumes `\1`-`\9` as backref, so the only octal-leading digit
+     that reaches here from the top level is `\0` -- but parse_escape
+     also fires from read_class_atom inside `[...]`, where backref
+     parsing does not apply, so the full 0-7 range needs handling. */
+  case '0': case '1': case '2': case '3':
+  case '4': case '5': case '6': case '7': {
+    int val = ch - '0';
+    int n = 1;
+    while (n < 3) {
+      int d = peek(c);
+      if (d < '0' || d > '7') break;
+      val = val * 8 + (d - '0');
+      next_char(c);
+      n++;
+    }
+    return val & 0xff;
+  }
+  /* Hex escape `\xHH` (1-2 hex digits, value 0-255). Spinel does not
+     yet implement the `\x{HHHH}` form for codepoints above 0xff. */
+  case 'x': {
+    int val = 0;
+    int n = 0;
+    while (n < 2) {
+      int d = peek(c);
+      int v;
+      if (d >= '0' && d <= '9') v = d - '0';
+      else if (d >= 'a' && d <= 'f') v = d - 'a' + 10;
+      else if (d >= 'A' && d <= 'F') v = d - 'A' + 10;
+      else break;
+      val = val * 16 + v;
+      next_char(c);
+      n++;
+    }
+    return val & 0xff;
+  }
   default: return ch;  /* literal: \., \\, \/, \(, etc. */
   }
 }
@@ -255,7 +356,8 @@ compile_charclass(re_compiler *c)
        intact. */
     if (peek(c) == '\\') {
       int esc = (c->p + 1 < c->src_end) ? (uint8_t)c->p[1] : -1;
-      if (esc == 'd' || esc == 'D' || esc == 'w' || esc == 'W' || esc == 's' || esc == 'S') {
+      if (esc == 'd' || esc == 'D' || esc == 'w' || esc == 'W' ||
+          esc == 's' || esc == 'S' || esc == 'h' || esc == 'H') {
         next_char(c);  /* '\\' */
         next_char(c);  /* spec  */
         class_add_shorthand(cc, esc);
@@ -269,6 +371,13 @@ compile_charclass(re_compiler *c)
     if (peek(c) == '-' && c->p + 1 < c->src_end && c->p[1] != ']') {
       next_char(c);  /* skip '-' */
       uint32_t hi = read_class_atom(c);
+      /* Issue #778: reversed range like [z-a] is a hard error in
+         CRuby (RegexpError "empty range in char class"). Spinel
+         used to silently accept it and emit a class that matched
+         nothing. Raise instead. */
+      if (cp > hi) {
+        compile_error(c, "empty range in char class");
+      }
       if (cp < 128 && hi < 128) {
         class_set_range(cc, (uint8_t)cp, (uint8_t)hi);
       }
@@ -277,7 +386,7 @@ compile_charclass(re_compiler *c)
            Mixed ASCII/non-ASCII ranges are rare; stash the whole
            span in the codepoint list (the bitmap covers ASCII only,
            so a non-ASCII upper bound forces the codepoint path). */
-        if (cp <= hi) class_add_range(cc, cp, hi);
+        class_add_range(cc, cp, hi);
       }
     }
     else {
@@ -296,17 +405,31 @@ static mrb_bool
 parse_quantifier(re_compiler *c, int *min_out, int *max_out)
 {
   const char *save = c->p;
+  /* Issue #819: integer overflow in `min/max = ... * 10 + digit`
+     used to wrap to negative. CRuby caps quantifiers at a sane
+     internal limit. We pick 100000 -- larger than any reasonable
+     pattern but small enough that the subsequent emit loop can't
+     run forever. */
+  enum { RE_QUANT_MAX = 100000 };
   int min = 0, max = -1;
 
   while (peek(c) >= '0' && peek(c) <= '9') {
-    min = min * 10 + (next_char(c) - '0');
+    int d = next_char(c) - '0';
+    if (min > RE_QUANT_MAX || min * 10 + d > RE_QUANT_MAX) {
+      compile_error(c, "quantifier too big");
+    }
+    min = min * 10 + d;
   }
   if (peek(c) == ',') {
     next_char(c);
     if (peek(c) >= '0' && peek(c) <= '9') {
       max = 0;
       while (peek(c) >= '0' && peek(c) <= '9') {
-        max = max * 10 + (next_char(c) - '0');
+        int d = next_char(c) - '0';
+        if (max > RE_QUANT_MAX || max * 10 + d > RE_QUANT_MAX) {
+          compile_error(c, "quantifier too big");
+        }
+        max = max * 10 + d;
       }
     }
     /* else max = -1 (unlimited) */
@@ -319,6 +442,10 @@ parse_quantifier(re_compiler *c, int *min_out, int *max_out)
     return FALSE;
   }
   next_char(c);  /* skip '}' */
+  /* Issue #822: min > max is invalid. CRuby raises RegexpError. */
+  if (max >= 0 && min > max) {
+    compile_error(c, "invalid repeat count");
+  }
   *min_out = min;
   *max_out = max;
   return TRUE;
@@ -443,6 +570,42 @@ compile_atom(re_compiler *c)
           cap_name_len = (uint16_t)(c->p - cap_name);
           next_char(c);  /* skip > */
         }
+        else {
+          /* Inline-flag group `(?xim-xim:...)` or whole-group flag
+             `(?xim)`. Skip the flag chars (and optional `-flags`),
+             then either `:` (non-capturing body) or `)` (apply to
+             outer group). Spinel's compiler doesn't honour the
+             flag SEMANTICS yet -- /x in particular would need to
+             strip whitespace inside this sub-pattern only -- but
+             the parse now consumes the directive so compile_seq
+             advances. Without this, `(?x:foo)` left c->p stuck on
+             `?` and compile_seq's outer loop spun forever. */
+          int c1 = c->p[1];
+          int recognized_flag = (c1 == 'x' || c1 == 'i' || c1 == 'm' || c1 == 's' || c1 == 'u' || c1 == 'a');
+          if (recognized_flag) {
+            next_char(c);  /* skip ? */
+            while (peek(c) != ':' && peek(c) != ')' && peek(c) >= 0) next_char(c);
+            if (peek(c) == ':') {
+              next_char(c);  /* skip : */
+              capturing = FALSE;
+            }
+            else if (peek(c) == ')') {
+              /* `(?xim)` with no body — apply to the enclosing
+                 group; spinel doesn't track per-scope flags, so
+                 just consume the close paren and emit nothing.
+                 The atom loop will see the next token. */
+              next_char(c);
+              break;
+            }
+          }
+          else {
+            /* Unrecognized `(?<X>...` directive. Compile-error
+               instead of looping: better surface than the prior
+               infinite-loop wedge. */
+            compile_error(c, "unrecognized (? construct");
+            break;
+          }
+        }
       }
 
       uint16_t group = 0;
@@ -454,9 +617,18 @@ compile_atom(re_compiler *c)
         emit(c, RE_SAVE, 0, group * 2);
         if (cap_name) {
           /* register named capture */
+          /* Issue #823: cap_name points into the pattern source --
+             but when the pattern came from strip_extended, c->stripped
+             is freed at re_compile exit, leaving the name dangling.
+             Allocate a fresh copy so the named-capture table owns
+             its strings. */
+          char *name_copy = (char*)malloc(cap_name_len + 1);
+          if (!name_copy) compile_error(c, "out of memory");
+          memcpy(name_copy, cap_name, cap_name_len);
+          name_copy[cap_name_len] = '\0';
           c->named_captures = (re_named_capture*)realloc(c->named_captures,
             sizeof(re_named_capture) * (c->num_named + 1));
-          c->named_captures[c->num_named].name = cap_name;
+          c->named_captures[c->num_named].name = name_copy;
           c->named_captures[c->num_named].name_len = cap_name_len;
           c->named_captures[c->num_named].group = group;
           c->num_named++;
@@ -506,7 +678,23 @@ compile_atom(re_compiler *c)
       next_char(c);
       uint16_t id = add_class(c);
       class_add_shorthand(&c->classes[id], ch);
-      emit(c, (ch >= 'A' && ch <= 'Z') ? RE_NCLASS : RE_CLASS, (uint8_t)id, 0);
+      /* class_add_shorthand already builds the directly-matching set for
+         every shorthand -- positive for d/w/s, the explicit complement
+         (plus utf8_any) for D/W/S -- so emit RE_CLASS for all of them.
+         The old `uppercase -> RE_NCLASS` route negated the complement a
+         second time, so top-level \D/\W/\S matched exactly the set they
+         should reject. The `[...]` path was unaffected (no NCLASS wrapper)
+         and stays correct. Mirrors the \h/\H arm below. */
+      emit(c, RE_CLASS, (uint8_t)id, 0);
+    }
+    else if (ch == 'h' || ch == 'H') {
+      /* \h / \H both carry their full positive set (hex digits /
+         non-hex-digits), so emit RE_CLASS for both rather than routing
+         \H through the uppercase RE_NCLASS path. */
+      next_char(c);
+      uint16_t id = add_class(c);
+      class_add_shorthand(&c->classes[id], ch);
+      emit(c, RE_CLASS, (uint8_t)id, 0);
     }
     else if (ch == 'A') {
       next_char(c);
@@ -551,9 +739,14 @@ compile_atom(re_compiler *c)
     break;
 
   default:
-    if (ch < 0 || ch == ')' || ch == '|' || ch == '*' || ch == '+' || ch == '?' || ch == '{') {
+    if (ch < 0 || ch == ')' || ch == '|' || ch == '*' || ch == '+' || ch == '?') {
       return;  /* not an atom */
     }
+    /* `{` with no preceding atom (or after one whose quantifier
+       parse failed) is a literal `{`. Without this, compile_seq's
+       outer loop spins -- compile_quantified returns no-atom and
+       the loop never advances. CRuby treats `/{re}/` as matching
+       the literal text `{re}`; we mirror that here. Issue #548. */
     next_char(c);
     if ((c->flags & RE_FLAG_IGNORECASE) && ch < 128) {
       if (ch >= 'A' && ch <= 'Z') {
@@ -582,7 +775,18 @@ compile_quantified(re_compiler *c)
 {
   uint32_t start = c->code_len;
   compile_atom(c);
-  if (c->code_len == start) return;  /* no atom emitted */
+  if (c->code_len == start) {
+    /* Issue #825: when compile_atom emitted nothing AND the next
+       char is a bare quantifier (star, plus, question), the
+       surrounding seq loop has nothing to advance with and spins
+       forever. Raise instead. CRuby: RegexpError "target of
+       repeat operator is not specified". */
+    int qch = peek(c);
+    if (qch == '*' || qch == '+' || qch == '?') {
+      compile_error(c, "target of repeat operator is not specified");
+    }
+    return;  /* no atom emitted, no quantifier -- caller handles */
+  }
 
   int ch = peek(c);
   if (ch == '*' || ch == '+' || ch == '?') {
@@ -684,30 +888,40 @@ compile_alt(re_compiler *c)
      insert a SPLIT before it by shifting code. */
 
   /* Collect all alternatives, then emit SPLIT chain at the end.
-     This avoids insert_inst offset corruption for multi-way alternation. */
-  uint32_t alt_starts[64];  /* start positions of each alternative */
-  int num_alts = 0;
+     This avoids insert_inst offset corruption for multi-way alternation.
+     alt_starts grows dynamically; the only ceiling is the offset field's
+     uint16_t width (~65535), enforced later when the SPLIT chain is
+     wired up. Issue #777. */
+  uint32_t alt_cap = 64;
+  uint32_t *alt_starts = (uint32_t *)malloc(sizeof(uint32_t) * alt_cap);
+  if (!alt_starts) compile_error(c, "out of memory");
+  uint32_t num_alts = 0;
   alt_starts[num_alts++] = alt_start;
 
   while (peek(c) == '|') {
     next_char(c);
     emit(c, RE_JMP, 0, 0);  /* placeholder: jump to end */
+    if (num_alts >= alt_cap) {
+      alt_cap *= 2;
+      uint32_t *grown = (uint32_t *)realloc(alt_starts, sizeof(uint32_t) * alt_cap);
+      if (!grown) { free(alt_starts); compile_error(c, "out of memory"); }
+      alt_starts = grown;
+    }
     alt_starts[num_alts++] = c->code_len;
-    if (num_alts >= 64) compile_error(c, "too many alternatives");
     compile_seq(c);
   }
 
-  if (num_alts <= 1) return;  /* shouldn't happen, but safety */
+  if (num_alts <= 1) { free(alt_starts); return; }
 
   /* Now insert SPLIT chain before the alternatives.
      For n alternatives: n-1 SPLIT instructions, each pointing to
      their respective alternative. */
-  uint32_t split_count = (uint32_t)(num_alts - 1);
+  uint32_t split_count = num_alts - 1;
   /* Insert split_count instructions at alt_starts[0] */
   for (uint32_t i = 0; i < split_count; i++) {
     insert_inst(c, alt_starts[0], RE_JMP, 0, 0);  /* placeholder */
     /* adjust all alt_starts by +1 due to insertion */
-    for (int j = 0; j < num_alts; j++) {
+    for (uint32_t j = 0; j < num_alts; j++) {
       alt_starts[j]++;
     }
   }
@@ -715,18 +929,28 @@ compile_alt(re_compiler *c)
   /* Now set up SPLIT chain: each SPLIT tries next instruction or jumps to alt */
   for (uint32_t i = 0; i < split_count; i++) {
     uint32_t pos = alt_starts[0] - split_count + i;
+    uint32_t target = alt_starts[i + 1];
+    if (target > 0xFFFF) {
+      free(alt_starts);
+      compile_error(c, "regex too large (alternation offset overflow)");
+    }
     c->code[pos].op = RE_SPLIT;
     c->code[pos].a = 0;
-    c->code[pos].offset = (uint16_t)alt_starts[i + 1];
+    c->code[pos].offset = (uint16_t)target;
   }
 
   /* Patch JMPs (they are right before each alt_starts[1..n-1]) to point to end */
   uint32_t end = c->code_len;
-  for (int i = 1; i < num_alts; i++) {
+  if (end > 0xFFFF) {
+    free(alt_starts);
+    compile_error(c, "regex too large (end offset overflow)");
+  }
+  for (uint32_t i = 1; i < num_alts; i++) {
     uint32_t jmp_pos = alt_starts[i] - 1;
     c->code[jmp_pos].op = RE_JMP;
     c->code[jmp_pos].offset = (uint16_t)end;
   }
+  free(alt_starts);
 }
 
 /*
@@ -824,12 +1048,19 @@ first_set_walk(const re_inst *code, uint32_t code_len,
     case RE_ANY: case RE_ANY_NL:
       return FALSE;  /* any byte possible */
     case RE_MATCH:
-      return TRUE;  /* empty match; first_bytes still valid for other branches */
+      /* Reaching MATCH via epsilon transitions means the regex can match
+         zero characters at any position. Skipping bytes that aren't in the
+         first-byte set would skip past valid empty-match positions, so the
+         optimization isn't safe -- bail out and accept any starting byte.
+         Imported from mruby d21eceb286. */
+      return FALSE;
     default:
       return FALSE;
     }
   }
-  return TRUE;
+  /* Walked off the end without hitting MATCH or a consuming op. Treat as
+     empty-matchable, same as RE_MATCH. */
+  return FALSE;
 }
 
 static mrb_bool
@@ -969,7 +1200,16 @@ re_free(mrb_regexp_pattern *pat)
       }
       free(pat->classes);
     }
-    free(pat->named_captures);
+    /* Issue #823: per-name buffers now owned by the table; free each
+       before freeing the array itself. Names registered before the
+       fix were uninit memory pointers but the new allocator path
+       gives us our own copy. */
+    if (pat->named_captures) {
+      for (uint16_t i = 0; i < pat->num_named; i++) {
+        free((void *)pat->named_captures[i].name);
+      }
+      free(pat->named_captures);
+    }
     free(pat->prefix);
     free(pat->cached_visited);
     free(pat->cached_threads[0]);