vm: heap corruption bug.

* vm.c (vm_execute_toplevel): Fix data vector being assigned
to the wrong display frame, leaving vm.dspl[1].vec
uninitialized. Why is that a problem? Because the VM depends
on these vectors when performing the vm_set operation: if a
frame register is stored, and the frame has an associated
vector, mut_obj is invoked on that vector. Now that there
exists the load-time operator, the d regs (which live in
dspl[1]) can be mutated.  That causes mut_obj to be called
with garbage. This was all discovered during testing on PPC64.

1 files changed, 1 insertions, 1 deletions

diff --git a/vm.c b/vm.c
index 8119fcf0..218d427a 100644
--- a/vm.c
+++ b/vm.c
@@ -999,7 +999,7 @@ val vm_execute_toplevel(val desc)
   vm.dspl[0].vec = nil;
 
   vm.dspl[1].mem = vd->data;
-  vm.dspl[0].vec = vd->datavec;
+  vm.dspl[1].vec = vd->datavec;
 
   return vm_execute(&vm);
 }