reload AR table body for transient heap.

ar_talbe (Hash representation for <=8 size) can use transient heap
and the memory area can move. So we need to restore `pair' ptr after
`func` call (which can run any programs) because of moving.
[Bug #16503]

1 files changed, 1 insertions, 0 deletions

diff --git a/hash.c b/hash.c
index 82383e9a93..1d97ccadd3 100644
--- a/hash.c
+++ b/hash.c
@@ -961,6 +961,7 @@ ar_foreach_check(VALUE hash, st_foreach_check_callback_func *func, st_data_t arg
 
             switch (retval) {
               case ST_CHECK: {
+                  pair = RHASH_AR_TABLE_REF(hash, i);
                   if (pair->key == never) break;
                   ret = ar_find_entry_hint(hash, hint, key);
                   if (ret == RHASH_AR_TABLE_MAX_BOUND) {