Use `mrb_ensure_hash_type()` to check if an operand is a `Hash`; fix #4097

src/vm.c

@@ -2720,10 +2720,11 @@ RETRY_TRY_BLOCK:
     }
 
     CASE(OP_HASHADD, BB) {
-      mrb_value hash = regs[a];
+      mrb_value hash;
       int i;
       int lim = a+b*2+1;
 
+      hash = mrb_ensure_hash_type(mrb, regs[a]);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }
@@ -2731,7 +2732,9 @@ RETRY_TRY_BLOCK:
       NEXT;
     }
     CASE(OP_HASHCAT, B) {
-      mrb_hash_merge(mrb, regs[a], regs[a+1]);
+      mrb_value hash = mrb_ensure_hash_type(mrb, regs[a]);
+
+      mrb_hash_merge(mrb, hash, regs[a+1]);
       mrb_gc_arena_restore(mrb, ai);
       NEXT;
     }