Fix limit check in narrow_conv_backprop().

Thanks to Sergey Kaplun. #1262

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index 700c23d4..2f02407c 100644
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -341,7 +341,8 @@ static int narrow_conv_backprop(NarrowConv *nc, IRRef ref, int depth)
       NarrowIns *savesp = nc->sp;
       int count = narrow_conv_backprop(nc, ir->op1, depth);
       count += narrow_conv_backprop(nc, ir->op2, depth);
-      if (count <= 1) {  /* Limit total number of conversions. */
+      /* Limit total number of conversions. */
+      if (count <= 1 && nc->sp < nc->maxsp) {
         *nc->sp++ = NARROWINS(IRT(ir->o, nc->t), ref);
         return count;
       }