Only emit proper parent references in snapshot replay.

Thanks to Peter Cawley. #1132

1 files changed, 8 insertions, 4 deletions

diff --git a/src/lj_snap.c b/src/lj_snap.c
index 5a5c481b..b387dd76 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -510,12 +510,14 @@ void lj_snap_replay(jit_State *J, GCtrace *T)
       IRRef refp = snap_ref(sn);
       IRIns *ir = &T->ir[refp];
       if (regsp_reg(ir->r) == RID_SUNK) {
+        uint8_t m;
         if (J->slot[snap_slot(sn)] != snap_slot(sn)) continue;
         pass23 = 1;
         lua_assert(ir->o == IR_TNEW || ir->o == IR_TDUP ||
                    ir->o == IR_CNEW || ir->o == IR_CNEWI);
-        if (ir->op1 >= T->nk) snap_pref(J, T, map, nent, seen, ir->op1);
-        if (ir->op2 >= T->nk) snap_pref(J, T, map, nent, seen, ir->op2);
+        m = lj_ir_mode[ir->o];
+        if (irm_op1(m) == IRMref) snap_pref(J, T, map, nent, seen, ir->op1);
+        if (irm_op2(m) == IRMref) snap_pref(J, T, map, nent, seen, ir->op2);
         if (LJ_HASFFI && ir->o == IR_CNEWI) {
           if (LJ_32 && refp+1 < T->nins && (ir+1)->o == IR_HIOP)
             snap_pref(J, T, map, nent, seen, (ir+1)->op2);
@@ -542,14 +544,16 @@ void lj_snap_replay(jit_State *J, GCtrace *T)
       IRIns *ir = &T->ir[refp];
       if (regsp_reg(ir->r) == RID_SUNK) {
         TRef op1, op2;
+        uint8_t m;
         if (J->slot[snap_slot(sn)] != snap_slot(sn)) {  /* De-dup allocs. */
           J->slot[snap_slot(sn)] = J->slot[J->slot[snap_slot(sn)]];
           continue;
         }
         op1 = ir->op1;
-        if (op1 >= T->nk) op1 = snap_pref(J, T, map, nent, seen, op1);
+        m = lj_ir_mode[ir->o];
+        if (irm_op1(m) == IRMref) op1 = snap_pref(J, T, map, nent, seen, op1);
         op2 = ir->op2;
-        if (op2 >= T->nk) op2 = snap_pref(J, T, map, nent, seen, op2);
+        if (irm_op2(m) == IRMref) op2 = snap_pref(J, T, map, nent, seen, op2);
         if (LJ_HASFFI && ir->o == IR_CNEWI) {
           if (LJ_32 && refp+1 < T->nins && (ir+1)->o == IR_HIOP) {
             lj_needsplit(J);  /* Emit joining HIOP. */