diff --git a/test/ruby/test_keyword.rb b/test/ruby/test_keyword.rb
index bcb93a6348..ad0bf63492 100644
--- a/test/ruby/test_keyword.rb
+++ b/test/ruby/test_keyword.rb
@@ -609,4 +609,24 @@ class TestKeywordArguments < Test::Unit::TestCase
       assert_equal({x: 1, y: 2, **h}, obj.foo)
     }
   end
+
+  def test_kwrest_overwritten
+    bug13015 = '[ruby-core:78536] [Bug #13015]'
+
+    klass = EnvUtil.labeled_class("Parent") do
+      def initialize(d:)
+      end
+    end
+
+    klass = EnvUtil.labeled_class("Child", klass) do
+      def initialize(d:, **h)
+        h = [2, 3]
+        super
+      end
+    end
+
+    assert_raise_with_message(TypeError, /expected Hash/, bug13015) do
+      klass.new(d: 4)
+    end
+  end
 end
diff --git a/vm.c b/vm.c
index daa043d863..67a6e8e164 100644
--- a/vm.c
+++ b/vm.c
@@ -2600,6 +2600,7 @@ core_hash_merge(VALUE hash, long argc, const VALUE *argv)
 {
     long i;
 
+    Check_Type(hash, T_HASH);
     VM_ASSERT(argc % 2 == 0);
     for (i=0; i<argc; i+=2) {
 	rb_hash_aset(hash, argv[i], argv[i+1]);
@@ -2620,7 +2621,7 @@ core_hash_from_ary(VALUE ary)
 {
     VALUE hash = rb_hash_new();
 
-    RUBY_DTRACE_CREATE_HOOK(HASH, RARRAY_LEN(ary));
+    RUBY_DTRACE_CREATE_HOOK(HASH, (Check_Type(ary, T_ARRAY), RARRAY_LEN(ary)));
     return core_hash_merge_ary(hash, ary);
 }
 
@@ -2634,6 +2635,7 @@ m_core_hash_merge_ary(VALUE self, VALUE hash, VALUE ary)
 static VALUE
 core_hash_merge_ary(VALUE hash, VALUE ary)
 {
+    Check_Type(ary, T_ARRAY);
     core_hash_merge(hash, RARRAY_LEN(ary), RARRAY_CONST_PTR(ary));
     return hash;
 }