Refer to irep_capa as well as irep_len when irep is marked by GC.

Initialize mrb->irep array with 0 when realloc is called.

src/gc.c

@@ -587,8 +587,10 @@ root_scan_phase(mrb_state *mrb)
     mrb_gc_mark(mrb, (struct RBasic*)ci->target_class);
   }
   /* mark irep pool */
-  for (i=0; i<mrb->irep_len; i++) {
   if (mrb->irep) {
+    size_t len = mrb->irep_len;
+    if (len > mrb->irep_capa) len = mrb->irep_capa;
+    for (i=0; i<len; i++) {
       mrb_irep *irep = mrb->irep[i];
       if (!irep) continue;
       for (j=0; j<irep->plen; j++) {

src/state.c

@@ -83,10 +83,12 @@ mrb_add_irep(mrb_state *mrb, int idx)
     mrb->irep_capa = max;
   }
   else if (mrb->irep_capa <= idx) {
+    size_t old_capa = mrb->irep_capa;
     while (mrb->irep_capa <= idx) {
       mrb->irep_capa *= 2;
     }
     mrb->irep = (mrb_irep **)mrb_realloc(mrb, mrb->irep, sizeof(mrb_irep*)*mrb->irep_capa);
+    memset(mrb->irep + old_capa, 0, sizeof(mrb_irep*) * (mrb->irep_capa - old_capa));
   }
 }