From f296a0c10dcc5039f614c729fa7519c806a86bf0 Mon Sep 17 00:00:00 2001
From: John Alanbrook <john@pockle.world>
Date: Fri, 13 Feb 2026 03:08:27 -0600
Subject: [PATCH] fix segv

---
 source/mach.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source/mach.c b/source/mach.c
index bc6e8e9f..394bd343 100644
--- a/source/mach.c
+++ b/source/mach.c
@@ -767,9 +767,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
   /* Setup initial frame — wrap top-level code in a function object so that
      returning from a called register function can read code/env from frame */
   JSValue top_fn = js_new_register_function(ctx, code, env_gc.val, of_gc.val);
-  JS_PopGCRef(ctx, &of_gc);
   env = env_gc.val; /* refresh — GC may have moved env during allocation */
-  JS_PopGCRef(ctx, &env_gc);
   frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
   frame->function = top_fn;
   frame->slots[0] = this_gc.val;  /* slot 0 = this */
@@ -780,6 +778,8 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
   }
   for (int i = nargs_copy - 1; i >= 0; i--) JS_PopGCRef(ctx, &arg_gcs[i]);
   JS_PopGCRef(ctx, &this_gc);
+  JS_PopGCRef(ctx, &of_gc);
+  JS_PopGCRef(ctx, &env_gc);
 
   uint32_t pc = code->entry_point;
   JSValue result = JS_NULL;