mruby-task: size the proc_set stack from the task's frame - #7308

This PR is a follow-up to #7279, fixing two more issues in mrb_task_proc_set().

Problem

1. Out-of-bounds write in suspended tasks

The function determines whether the task's stack needs to grow by comparing the proc's nregs against the total capacity (stend - stbase) instead of the available room above the current frame (ci->stack):

size_t cur = (size_t)(c->stend - c->stbase);
size_t need = (size_t)proc->body.irep->nregs;
if (need > cur) { ... }

A task suspended mid-call-chain holds its frame at an offset from the stack base. When the proc fits the total capacity but the frame offset + proc does not, the extension is skipped, and the resumed task writes past the stack. This is the edge case left open by #7279 (which only covered the reset_context + proc_set path where the frame sits exactly at the stack base).

Additionally, the error path has a related hole. A caller with no jmpbuf gets no re-raise from MRB_ENSURE. Consequently, after a failed stack extension, the function previously went on to install the proc on the stack it just failed to grow, leaving mrb->exc set but unchecked.

2. Invalid memory access via union aliasing and heap envs

The env resize logic below the stack growth blindly reads proc->body.irep->nlocals for any proc. Since body is a union, body.irep holds a C function on a cfunc proc and an mrb_sym on an alias proc. Reading it in these cases feeds MRB_ENV_SET_LEN an invalid value read through the wrong union member.

Furthermore, the final install crashes on an alias proc because CI_PROC_SET refuses aliases. Passing NULL also dies on the flag test before reaching CI_PROC_SET's NULL branch.

Finally, the block widens an env that may no longer be backed by the task's stack. A heap env owns exactly MRB_ENV_LEN slots, so artificially growing its length sends GC marking and the unshare copy past its allocation boundaries.

Fix

• Stack growth: Compare the required size against the room above the frame using a wrap-safe pointer comparison. An exact fit is allowed, meaning a proc that the frame already holds does not unnecessarily touch the allocator.
• Error handling: Bail out when the extend fails. This keeps the old proc instead of installing one that the stack cannot hold.
• Alias resolution: Follow the alias chain to the actual target proc (similar to mrb_proc_arity()), tolerate NULL, and size/install the properly resolved proc.
• Env resizing: Widen the base env only while it is strictly backed by the task's stack.

Testing

Added a regression test that suspends a task deep in a call chain and then sets a larger proc. Without the fix, it fails with the stack left at 64 slots, which cannot hold the required frame offset of 26 plus 43 registers.

Summary by CodeRabbit

• Bug Fixes

  • Improved task procedure replacement when procedures are aliased or have different execution types.
  • Prevented invalid installation when task stack expansion fails.
  • Improved stack sizing for procedures installed on deeply nested suspended tasks.
  • Made environment resizing safer during task updates.

• Tests

  • Added regression coverage for replacing procedures on suspended tasks with deep call stacks.