diff --git a/ChangeLog b/ChangeLog
index 265eb22fd3..bb91a8c63c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Tue Jul 10 19:16:28 2007  Koichi Sasada  <ko1@atdot.net>
+
+	* eval.c, insnhelper.ci, vm.c: change cref index (-1 -> 2).
+
 Tue Jul 10 18:49:56 2007  Koichi Sasada  <ko1@atdot.net>
 
 	* eval.c (exec_under): add proper casts.
diff --git a/eval.c b/eval.c
index 3212de09d9..1f0228642c 100644
--- a/eval.c
+++ b/eval.c
@@ -1813,8 +1813,8 @@ exec_under(VALUE (*func) (VALUE), VALUE under, VALUE self, VALUE args)
 	cfp = RUBY_VM_PREVIOUS_CONTROL_FRAME(cfp);
     }
 
-    stored_cref = (NODE *)vm_cfp_svar_get(th, cfp, (VALUE)-1);
-    vm_cfp_svar_set(th, cfp, (VALUE)-1, (VALUE)vm_cref_push(th, under, NOEX_PUBLIC));
+    stored_cref = (NODE *)vm_cfp_svar_get(th, cfp, 2);
+    vm_cfp_svar_set(th, cfp, 2, (VALUE)vm_cref_push(th, under, NOEX_PUBLIC));
 
     PUSH_TAG();
     if ((state = EXEC_TAG()) == 0) {
@@ -1823,7 +1823,7 @@ exec_under(VALUE (*func) (VALUE), VALUE under, VALUE self, VALUE args)
     POP_TAG();
 
     /* restore environment */
-    vm_cfp_svar_set(th, cfp, (VALUE)-1, (VALUE)stored_cref);
+    vm_cfp_svar_set(th, cfp, 2, (VALUE)stored_cref);
     pcfp->self = stored_self;
 
     if (state) {
diff --git a/insnhelper.ci b/insnhelper.ci
index 2b33e6b1d6..7df4ef8fa2 100644
--- a/insnhelper.ci
+++ b/insnhelper.ci
@@ -775,12 +775,12 @@ lfp_svar_get(rb_thread_t *th, VALUE *lfp, VALUE key)
     struct RValues *svar = lfp_svar_place(th, lfp);
 
     switch (key) {
-      case (VALUE)-1:
-	return svar->basic.klass;
       case 0:
 	return svar->v1;
       case 1:
 	return svar->v2;
+      case 2:
+	return svar->basic.klass;
       default: {
 	  VALUE hash = svar->v3;
 
@@ -800,15 +800,15 @@ lfp_svar_set(rb_thread_t *th, VALUE *lfp, VALUE key, VALUE val)
     struct RValues *svar = lfp_svar_place(th, lfp);
 
     switch (key) {
-      case (VALUE)-1:
-	svar->basic.klass = val;
-	return;
       case 0:
 	svar->v1 = val;
 	return;
       case 1:
 	svar->v2 = val;
 	return;
+      case 2:
+	svar->basic.klass = val;
+	return;
       default: {
 	  VALUE hash = svar->v3;
 
diff --git a/vm.c b/vm.c
index a952f5e029..0aae865770 100644
--- a/vm.c
+++ b/vm.c
@@ -812,7 +812,6 @@ static NODE *
 lfp_set_special_cref(VALUE *lfp, NODE * cref)
 {
     struct RValues *values = (void *) lfp[-1];
-    VALUE *pv;
     NODE *old_cref;
 
     if (VMDEBUG) {
@@ -823,8 +822,8 @@ lfp_set_special_cref(VALUE *lfp, NODE * cref)
 	old_cref = 0;
     }
     else {
-	old_cref = lfp_svar_get(GET_THREAD(), lfp, -1);
-	lfp_svar_set(GET_THREAD(), lfp, -1, cref);
+	old_cref = (NODE *)lfp_svar_get(GET_THREAD(), lfp, 2);
+	lfp_svar_set(GET_THREAD(), lfp, 2, (VALUE)cref);
     }
     return old_cref;
 }