Fix off-by-one errors in maxslot calculation of trace recorder.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lj_record.c b/src/lj_record.c
index 2bb1c2c8..f82468f0 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -628,7 +628,7 @@ static void rec_ret(jit_State *J, BCReg rbase, ptrdiff_t gotresults)
       /* Copy result to destination slot. */
       BCReg dst = bc_a(*(frame_contpc(frame)-1));
       J->base[dst] = gotresults ? J->base[cbase+rbase] : TREF_NIL;
-      if (dst > J->maxslot) J->maxslot = dst+1;
+      if (dst >= J->maxslot) J->maxslot = dst+1;
     } else if (cont == lj_cont_nop) {
       /* Nothing to do here. */
     } else if (cont == lj_cont_cat) {
@@ -659,7 +659,7 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
       nresults = nvararg;
       J->maxslot = dst + nvararg;
     } else if (dst + nresults > J->maxslot) {
-      J->maxslot = dst + nresults + 1;
+      J->maxslot = dst + nresults;
     }
     for (i = 0; i < nresults; i++)
       J->base[dst+i] = i < nvararg ? J->base[i - nvararg - 1] : TREF_NIL;