Another fix for the trace flush logic. I'll get this right someday.

Thanks to David Manura.

2 files changed, 12 insertions, 9 deletions

diff --git a/doc/ext_jit.html b/doc/ext_jit.html
index fc494382..36e306a8 100644
--- a/doc/ext_jit.html
+++ b/doc/ext_jit.html
@@ -116,9 +116,9 @@ debugging purposes.
 
 <h3 id="jit_flush_tr"><tt>jit.flush(tr)</tt></h3>
 <p>
-Flushes the specified root trace and all of its side traces from the cache.
-The code for the trace will be retained as long as there are any other
-traces which link to it.
+Flushes the root trace, specified by its number, and all of its side
+traces from the cache. The code for the trace will be retained as long
+as there are any other traces which link to it.
 </p>
 
 <h3 id="jit_status"><tt>status, ... = jit.status()</tt></h3>
diff --git a/src/lj_trace.c b/src/lj_trace.c
index c6e87bb5..612a41bc 100644
--- a/src/lj_trace.c
+++ b/src/lj_trace.c
@@ -194,8 +194,9 @@ static void trace_unpatch(jit_State *J, GCtrace *T)
     lua_assert(bc_op(*pc) == BC_JFORI);
     setbc_op(pc, BC_FORI);
     break;
+  case BC_JITERL:
   case BC_JLOOP:
-    lua_assert(op == BC_LOOP || bc_isret(op));
+    lua_assert(op == BC_ITERL || op == BC_LOOP || bc_isret(op));
     *pc = T->startins;
     break;
   case BC_JMP:
@@ -227,11 +228,13 @@ static void trace_flushroot(jit_State *J, GCtrace *T)
     pt->trace = T->nextroot;
   } else {  /* Otherwise search in chain of root traces. */
     GCtrace *T2 = traceref(J, pt->trace);
-    for (; T2->nextroot; T2 = traceref(J, T2->nextroot))
-      if (T2->nextroot == T->traceno) {
-        T2->nextroot = T->nextroot;  /* Unlink from chain. */
-        break;
-      }
+    if (T2) {
+      for (; T2->nextroot; T2 = traceref(J, T2->nextroot))
+        if (T2->nextroot == T->traceno) {
+          T2->nextroot = T->nextroot;  /* Unlink from chain. */
+          break;
+        }
+    }
   }
 }