Fix anchoring for string buffer set() method (again).

Thanks to Peter Cawley. #1125

1 files changed, 4 insertions, 7 deletions

diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c
index c70793a4..30dc6bfc 100644
--- a/src/lj_ffrecord.c
+++ b/src/lj_ffrecord.c
@@ -1205,14 +1205,11 @@ static void LJ_FASTCALL recff_buffer_method_set(jit_State *J, RecordFFData *rd)
     TRef trp = emitir(IRT(IR_STRREF, IRT_PGC), tr, lj_ir_kint(J, 0));
     TRef len = emitir(IRTI(IR_FLOAD), tr, IRFL_STR_LEN);
     IRIns *irp = IR(tref_ref(trp));
-    /* Anchor (potentially different) obj into which trp points after fold. */
-    if (irp->o == IR_STRREF) {
+    /* trp must point into the anchored obj, even after folding. */
+    if (irp->o == IR_STRREF)
       tr = irp->op1;
-    } else if (irp->o == IR_KKPTR && !tref_isk(tr)) {
-      GCstr *str = strV(&rd->argv[1]);  /* Constify the argument. */
-      tr = lj_ir_kstr(J, str);
-      trp = lj_ir_kkptr(J, (char *)strdata(str));
-    }
+    else if (!tref_isk(tr))
+      trp = emitir(IRT(IR_ADD, IRT_PGC), tr, lj_ir_kintpgc(J, sizeof(GCstr)));
     lj_ir_call(J, IRCALL_lj_bufx_set, trbuf, trp, len, tr);
 #if LJ_HASFFI
   } else if (tref_iscdata(tr)) {