diff --git a/ChangeLog b/ChangeLog
index 44115021f5..54450516c8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+Wed Feb  6 00:46:53 2013  Kazuki Tsujimoto  <kazuki@callcc.net>
+
+	* vm.c (rb_vm_stack_to_heap): call rb_vm_get_binding_creatable_next_cfp
+	  instead of rb_vm_get_ruby_level_next_cfp to prevent a segfault by
+	  calling Kernel#callcc. See r39067 for more details.
+	  [ruby-dev:46908] [ruby-trunk - Bug #7774]
+
+	* test/ruby/test_settracefunc.rb: add a test.
+
 Tue Feb  5 18:48:00 2013  Charlie Somerville  <charlie@charliesomerville.com>
 
 	* doc/security.rdoc: add regex, eval and drb sections
diff --git a/test/ruby/test_settracefunc.rb b/test/ruby/test_settracefunc.rb
index cfb06010ef..b4143c602c 100644
--- a/test/ruby/test_settracefunc.rb
+++ b/test/ruby/test_settracefunc.rb
@@ -943,7 +943,8 @@ class TestSetTraceFunc < Test::Unit::TestCase
   end
 
   def test_trace_point_binding_in_ifunc
-    assert_normal_exit %q{
+    bug7774 = '[ruby-dev:46908]'
+    src = %q{
       tp = TracePoint.new(:raise) do |tp|
         tp.binding
       end
@@ -955,8 +956,18 @@ class TestSetTraceFunc < Test::Unit::TestCase
             yield 1
           end
         end
-        obj.zip({}) {}
+        %s
       end
-    }, '[ruby-dev:46908] [ruby-trunk - Bug #7774]'
+    }
+    assert_normal_exit src % %q{obj.zip({}) {}}, bug7774
+    assert_normal_exit src % %q{
+      require 'continuation'
+      begin
+        c = nil
+        obj.sort_by {|x| callcc {|c2| c ||= c2 }; x }
+        c.call
+      rescue RuntimeError
+      end
+    }, bug7774
   end
 end
diff --git a/vm.c b/vm.c
index 698857ba33..36def2cfae 100644
--- a/vm.c
+++ b/vm.c
@@ -553,7 +553,7 @@ void
 rb_vm_stack_to_heap(rb_thread_t *th)
 {
     rb_control_frame_t *cfp = th->cfp;
-    while ((cfp = rb_vm_get_ruby_level_next_cfp(th, cfp)) != 0) {
+    while ((cfp = rb_vm_get_binding_creatable_next_cfp(th, cfp)) != 0) {
 	rb_vm_make_env_object(th, cfp);
 	cfp = RUBY_VM_PREVIOUS_CONTROL_FRAME(cfp);
     }