9 files changed, 19 insertions, 13 deletions

diff --git a/src/lj_asm_arm.h b/src/lj_asm_arm.h
index 6cfe5c70..3adb534b 100644
--- a/src/lj_asm_arm.h
+++ b/src/lj_asm_arm.h
@@ -1133,6 +1133,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
   }
   idx = asm_fuseahuref(as, ir->op1, &ofs, allow,
                        (!LJ_SOFTFP && t == IRT_NUM) ? 1024 : 4096);
+  if (ir->o == IR_VLOAD) ofs += 8 * ir->op2;
   if (!hiop || type == RID_NONE) {
     rset_clear(allow, idx);
     if (ofs < 256 && ra_hasreg(dest) && (dest & 1) == 0 &&
diff --git a/src/lj_asm_arm64.h b/src/lj_asm_arm64.h
index bb972ad1..f51c6f76 100644
--- a/src/lj_asm_arm64.h
+++ b/src/lj_asm_arm64.h
@@ -1078,6 +1078,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
   }
   type = ra_scratch(as, rset_clear(gpr, tmp));
   idx = asm_fuseahuref(as, ir->op1, &ofs, rset_clear(gpr, type), A64I_LDRx);
+  if (ir->o == IR_VLOAD) ofs += 8 * ir->op2;
   /* Always do the type check, even if the load result is unused. */
   asm_guardcc(as, irt_isnum(ir->t) ? CC_LS : CC_NE);
   if (irt_type(ir->t) >= IRT_NUM) {
diff --git a/src/lj_asm_mips.h b/src/lj_asm_mips.h
index 1fe934e1..cd32d038 100644
--- a/src/lj_asm_mips.h
+++ b/src/lj_asm_mips.h
@@ -1417,6 +1417,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
 #endif
   }
   idx = asm_fuseahuref(as, ir->op1, &ofs, allow);
+  if (ir->o == IR_VLOAD) ofs += 8 * ir->op2;
   rset_clear(allow, idx);
   if (irt_isnum(t)) {
     asm_guard(as, MIPSI_BEQ, RID_TMP, RID_ZERO);
diff --git a/src/lj_asm_ppc.h b/src/lj_asm_ppc.h
index f5cedd6a..ba60b7e6 100644
--- a/src/lj_asm_ppc.h
+++ b/src/lj_asm_ppc.h
@@ -1019,6 +1019,10 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
     rset_clear(allow, dest);
   }
   idx = asm_fuseahuref(as, ir->op1, &ofs, allow);
+  if (ir->o == IR_VLOAD) {
+    ofs = ofs != AHUREF_LSX ? ofs + 8 * ir->op2 :
+          ir->op2 ? 8 * ir->op2 : AHUREF_LSX;
+  }
   if (irt_isnum(t)) {
     Reg tisnum = ra_allock(as, (int32_t)LJ_TISNUM, rset_exclude(allow, idx));
     asm_guardcc(as, CC_GE);
diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 3c934c31..512f1afd 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -227,9 +227,6 @@ static void asm_fuseahuref(ASMState *as, IRRef ref, RegSet allow)
 #endif
       return;
     default:
-      lj_assertA(ir->o == IR_HREF || ir->o == IR_NEWREF || ir->o == IR_UREFO ||
-                 ir->o == IR_KKPTR,
-                 "bad IR op %d", ir->o);
       break;
     }
   }
@@ -490,6 +487,7 @@ static Reg asm_fuseload(ASMState *as, IRRef ref, RegSet allow)
       }
     } else if (ir->o == IR_VLOAD && !(LJ_GC64 && irt_isaddr(ir->t))) {
       asm_fuseahuref(as, ir->op1, xallow);
+      as->mrm.ofs += 8 * ir->op2;
       return RID_MRM;
     }
   }
@@ -1550,6 +1548,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
     Reg dest = asm_load_lightud64(as, ir, 1);
     if (ra_hasreg(dest)) {
       asm_fuseahuref(as, ir->op1, RSET_GPR);
+      if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
       emit_mrm(as, XO_MOV, dest|REX_64, RID_MRM);
     }
     return;
@@ -1559,6 +1558,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
     RegSet allow = irt_isnum(ir->t) ? RSET_FPR : RSET_GPR;
     Reg dest = ra_dest(as, ir, allow);
     asm_fuseahuref(as, ir->op1, RSET_GPR);
+    if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
 #if LJ_GC64
     if (irt_isaddr(ir->t)) {
       emit_shifti(as, XOg_SHR|REX_64, dest, 17);
@@ -1586,6 +1586,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir)
     }
 #endif
     asm_fuseahuref(as, ir->op1, gpr);
+    if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
   }
   /* Always do the type check, even if the load result is unused. */
   as->mrm.ofs += 4;
diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c
index 92902b70..3ef92034 100644
--- a/src/lj_ffrecord.c
+++ b/src/lj_ffrecord.c
@@ -1317,7 +1317,7 @@ static void LJ_FASTCALL recff_buffer_method_decode(jit_State *J, RecordFFData *r
   trr = lj_ir_call(J, IRCALL_lj_serialize_get, trbuf, tmp);
   /* No IR_USE needed, since the call is a store. */
   t = (IRType)lj_serialize_peektype(bufV(&rd->argv[0]));
-  J->base[0] = lj_record_vload(J, tmp, t);
+  J->base[0] = lj_record_vload(J, tmp, 0, t);
   /* The sbx->r store must be after the VLOAD type check, in case it fails. */
   recff_sbufx_set_ptr(J, ud, IRFL_SBUF_R, trr);
 }
@@ -1350,7 +1350,7 @@ static void LJ_FASTCALL recff_buffer_decode(jit_State *J, RecordFFData *rd)
     memset(&sbx, 0, sizeof(SBufExt));
     lj_bufx_set_cow(J->L, &sbx, strdata(str), str->len);
     t = (IRType)lj_serialize_peektype(&sbx);
-    J->base[0] = lj_record_vload(J, tmp, t);
+    J->base[0] = lj_record_vload(J, tmp, 0, t);
   }  /* else: Interpreter will throw. */
 }
 
diff --git a/src/lj_ir.h b/src/lj_ir.h
index b3faaea8..6a161933 100644
--- a/src/lj_ir.h
+++ b/src/lj_ir.h
@@ -106,7 +106,7 @@
   _(FLOAD,      L , ref, lit) \
   _(XLOAD,      L , ref, lit) \
   _(SLOAD,      L , lit, lit) \
-  _(VLOAD,      L , ref, ___) \
+  _(VLOAD,      L , ref, lit) \
   _(ALEN,       L , ref, ref) \
   \
   _(ASTORE,     S , ref, ref) \
diff --git a/src/lj_record.c b/src/lj_record.c
index ee62179b..a1471aae 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -260,9 +260,9 @@ TRef lj_record_constify(jit_State *J, cTValue *o)
 }
 
 /* Emit a VLOAD with the correct type. */
-TRef lj_record_vload(jit_State *J, TRef ref, IRType t)
+TRef lj_record_vload(jit_State *J, TRef ref, MSize idx, IRType t)
 {
-  TRef tr = emitir(IRTG(IR_VLOAD, t), ref, 0);
+  TRef tr = emitir(IRTG(IR_VLOAD, t), ref, idx);
   if (irtype_ispri(t)) tr = TREF_PRI(t);  /* Canonicalize primitives. */
   return tr;
 }
@@ -1848,9 +1848,7 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
         vbase = emitir(IRT(IR_ADD, IRT_PGC), vbase, lj_ir_kint(J, frofs-8));
         for (i = 0; i < nload; i++) {
           IRType t = itype2irt(&J->L->base[i-1-LJ_FR2-nvararg]);
-          TRef aref = emitir(IRT(IR_AREF, IRT_PGC),
-                             vbase, lj_ir_kint(J, (int32_t)i));
-          J->base[dst+i] = lj_record_vload(J, aref, t);
+          J->base[dst+i] = lj_record_vload(J, vbase, i, t);
         }
       } else {
         emitir(IRTGI(IR_LE), fr, lj_ir_kint(J, frofs));
@@ -1897,7 +1895,7 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
                        lj_ir_kint(J, frofs-(8<<LJ_FR2)));
         t = itype2irt(&J->L->base[idx-2-LJ_FR2-nvararg]);
         aref = emitir(IRT(IR_AREF, IRT_PGC), vbase, tridx);
-        tr = lj_record_vload(J, aref, t);
+        tr = lj_record_vload(J, aref, 0, t);
       }
       J->base[dst-2-LJ_FR2] = tr;
       J->maxslot = dst-1-LJ_FR2;
diff --git a/src/lj_record.h b/src/lj_record.h
index 03d84a71..3bf461c8 100644
--- a/src/lj_record.h
+++ b/src/lj_record.h
@@ -30,7 +30,7 @@ LJ_FUNC int lj_record_objcmp(jit_State *J, TRef a, TRef b,
                              cTValue *av, cTValue *bv);
 LJ_FUNC void lj_record_stop(jit_State *J, TraceLink linktype, TraceNo lnk);
 LJ_FUNC TRef lj_record_constify(jit_State *J, cTValue *o);
-LJ_FUNC TRef lj_record_vload(jit_State *J, TRef ref, IRType t);
+LJ_FUNC TRef lj_record_vload(jit_State *J, TRef ref, MSize idx, IRType t);
 
 LJ_FUNC void lj_record_call(jit_State *J, BCReg func, ptrdiff_t nargs);
 LJ_FUNC void lj_record_tailcall(jit_State *J, BCReg func, ptrdiff_t nargs);