Fix TNEW load forwarding with instable types.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 9f714056..f7833654 100644
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -179,7 +179,8 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)
         }
         ref = store->prev;
       }
-      lua_assert(ir->o != IR_TNEW || irt_isnil(fins->t));
+      if (ir->o == IR_TNEW && !irt_isnil(fins->t))
+        return 0;  /* Type instability in loop-carried dependency. */
       if (irt_ispri(fins->t)) {
         return TREF_PRI(irt_type(fins->t));
       } else if (irt_isnum(fins->t) || (LJ_DUALNUM && irt_isint(fins->t)) ||