2 files changed, 11 insertions, 8 deletions

diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 7931ffb5..1b94371e 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -1247,14 +1247,15 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge)
       } else {
         emit_rr(as, XO_MOV, tmp, key);
 #if LJ_GC64
-       emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15);
-       if ((as->flags & JIT_F_BMI2)) {
-         emit_i8(as, 32);
-         emit_mrm(as, XV_RORX|VEX_64, dest, key);
-       } else {
-         emit_shifti(as, XOg_SHR|REX_64, dest, 32);
-         emit_rr(as, XO_MOV, dest|REX_64, key|REX_64);
-       }
+        checkmclim(as);
+        emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15);
+        if ((as->flags & JIT_F_BMI2)) {
+          emit_i8(as, 32);
+          emit_mrm(as, XV_RORX|VEX_64, dest, key);
+        } else {
+          emit_shifti(as, XOg_SHR|REX_64, dest, 32);
+          emit_rr(as, XO_MOV, dest|REX_64, key|REX_64);
+        }
 #else
         emit_rmro(as, XO_LEA, dest, key, HASH_BIAS);
 #endif
diff --git a/src/lj_record.c b/src/lj_record.c
index a858ffa9..448db0cf 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -2263,6 +2263,8 @@ void lj_record_ins(jit_State *J)
     rc = lj_ir_kint(J, (int32_t)(int16_t)rc);
     break;
   case BC_KNIL:
+    if (LJ_FR2 && ra > J->maxslot)
+      J->base[ra-1] = 0;
     while (ra <= rc)
       J->base[ra++] = TREF_NIL;
     if (rc >= J->maxslot) J->maxslot = rc+1;