Save gc_arena after buffer got allocated

Latest fix was freeing the buffer while it was still in use.
Fixes #3712

mrbgems/mruby-string-ext/src/string.c

@@ -601,12 +601,12 @@ mrb_str_upto(mrb_state *mrb, mrb_value beg)
   if (ISDIGIT(RSTRING_PTR(beg)[0]) && ISDIGIT(RSTRING_PTR(end)[0]) &&
       all_digits_p(RSTRING_PTR(beg), RSTRING_LEN(beg)) &&
       all_digits_p(RSTRING_PTR(end), RSTRING_LEN(end))) {
-    int ai = mrb_gc_arena_save(mrb);
     mrb_int min_width = RSTRING_LEN(beg);
     mrb_int max_width = RSTRING_LEN(end);
     mrb_int bi = mrb_int(mrb, mrb_str_to_inum(mrb, beg, 10, FALSE));
     mrb_int ei = mrb_int(mrb, mrb_str_to_inum(mrb, end, 10, FALSE));
     mrb_value str = mrb_str_new(mrb, NULL, max_width);
+    int ai = mrb_gc_arena_save(mrb);
     char *buf = RSTRING_PTR(str);
 
     while (bi <= ei) {