The stack shift width should be determined by `p->upper`; fix #3864

And check required register number from `ci->proc` as well.
The fixes for #3859 and #3862 were incomplete.

src/vm.c

@@ -326,7 +326,10 @@ ecall(mrb_state *mrb)
   if (!p) return;
   mrb_assert(!MRB_PROC_CFUNC_P(p));
   c->ensure[i] = NULL;
+  nregs = p->upper->body.irep->nregs;
+  if (ci->proc->body.irep->nregs > nregs) {
     nregs = ci->proc->body.irep->nregs;
+  }
   cioff = ci - c->cibase;
   ci = cipush(mrb);
   ci->stackent = mrb->c->stack;
@@ -336,9 +339,9 @@ ecall(mrb_state *mrb)
   ci->proc = p;
   ci->nregs = p->body.irep->nregs;
   ci->target_class = MRB_PROC_TARGET_CLASS(p);
-  c->stack += nregs;
   env = MRB_PROC_ENV(p);
   mrb_assert(env);
+  c->stack += nregs;
   exc = mrb->exc; mrb->exc = 0;
   if (exc) {
     mrb_gc_protect(mrb, mrb_obj_value(exc));