18 files changed, 106 insertions, 78 deletions
diff --git a/src/Makefile b/src/Makefile
index 4a56d1e8..c83abfa0 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -302,6 +302,9 @@ endif
 ifneq (,$(INSTALL_LJLIBD))
  TARGET_XCFLAGS+= -DLUA_LJDIR=\"$(INSTALL_LJLIBD)\"
 endif
+ifeq (,$(shell $(TARGET_CC) -o /dev/null -c -x c /dev/null -fno-strict-float-cast-overflow 2>/dev/null || echo 1))
+  TARGET_XCFLAGS+= -fno-strict-float-cast-overflow
+endif
 ##############################################################################
 # Target system detection.
diff --git a/src/lj_asm_arm.h b/src/lj_asm_arm.h
index de435057..24deaeae 100644
--- a/src/lj_asm_arm.h
+++ b/src/lj_asm_arm.h
@@ -1927,7 +1927,7 @@ static void asm_hiop(ASMState *as, IRIns *ir)
  } else if ((ir-1)->o == IR_MIN || (ir-1)->o == IR_MAX) {
    as->curins--;  /* Always skip the loword min/max. */
    if (uselo || usehi)
-      asm_sfpmin_max(as, ir-1, (ir-1)->o == IR_MIN ? CC_PL : CC_LE);
+      asm_sfpmin_max(as, ir-1, (ir-1)->o == IR_MIN ? CC_HS : CC_LS);
    return;
 #elif LJ_HASFFI
  } else if ((ir-1)->o == IR_CONV) {
diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 936ff438..774e77b4 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -2084,7 +2084,8 @@ static void asm_intarith(ASMState *as, IRIns *ir, x86Arith xa)
  RegSet allow = RSET_GPR;
  Reg dest, right;
  int32_t k = 0;
-  if (as->flagmcp == as->mcp) {  /* Drop test r,r instruction. */
+  if (as->flagmcp == as->mcp && xa != XOg_X_IMUL) {
+    /* Drop test r,r instruction. */
    MCode *p = as->mcp + ((LJ_64 && *as->mcp < XI_TESTb) ? 3 : 2);
    MCode *q = p[0] == 0x0f ? p+1 : p;
    if ((*q & 15) < 14) {
diff --git a/src/lj_bc.h b/src/lj_bc.h
index a94ea4e4..53b3e501 100644
--- a/src/lj_bc.h
+++ b/src/lj_bc.h
@@ -259,6 +259,11 @@ static LJ_AINLINE int bc_isret(BCOp op)
  return (op == BC_RETM || op == BC_RET || op == BC_RET0 || op == BC_RET1);
 }
+static LJ_AINLINE int bc_isret_or_tail(BCOp op)
+{
+  return (op == BC_CALLMT || op == BC_CALLT || bc_isret(op));
+}
 LJ_DATA const uint16_t lj_bc_mode[];
 LJ_DATA const uint16_t lj_bc_ofs[];
diff --git a/src/lj_bcread.c b/src/lj_bcread.c
index ee7d7c18..55709522 100644
--- a/src/lj_bcread.c
+++ b/src/lj_bcread.c
@@ -179,7 +179,7 @@ static const void *bcread_varinfo(GCproto *pt)
 }
 /* Read a single constant key/value of a template table. */
-static void bcread_ktabk(LexState *ls, TValue *o)
+static void bcread_ktabk(LexState *ls, TValue *o, GCtab *t)
 {
  MSize tp = bcread_uleb128(ls);
  if (tp >= BCDUMP_KTAB_STR) {
@@ -191,6 +191,8 @@ static void bcread_ktabk(LexState *ls, TValue *o)
  } else if (tp == BCDUMP_KTAB_NUM) {
    o->u32.lo = bcread_uleb128(ls);
    o->u32.hi = bcread_uleb128(ls);
+  } else if (t && tp == BCDUMP_KTAB_NIL) { /* Restore nil value marker. */
+    settabV(ls->L, o, t);
  } else {
    lj_assertLS(tp <= BCDUMP_KTAB_TRUE, "bad constant type %d", tp);
    setpriV(o, ~tp);
@@ -207,15 +209,15 @@ static GCtab *bcread_ktab(LexState *ls)
    MSize i;
    TValue *o = tvref(t->array);
    for (i = 0; i < narray; i++, o++)
-      bcread_ktabk(ls, o);
+      bcread_ktabk(ls, o, NULL);
  }
  if (nhash) {  /* Read hash entries. */
    MSize i;
    for (i = 0; i < nhash; i++) {
      TValue key;
-      bcread_ktabk(ls, &key);
+      bcread_ktabk(ls, &key, NULL);
      lj_assertLS(!tvisnil(&key), "nil key");
-      bcread_ktabk(ls, lj_tab_set(ls->L, t, &key));
+      bcread_ktabk(ls, lj_tab_set(ls->L, t, &key), t);
    }
  }
  return t;
diff --git a/src/lj_bcwrite.c b/src/lj_bcwrite.c
index de200ef4..ec6f13c8 100644
--- a/src/lj_bcwrite.c
+++ b/src/lj_bcwrite.c
@@ -71,6 +71,8 @@ static void bcwrite_ktabk(BCWriteCtx *ctx, cTValue *o, int narrow)
    *p++ = BCDUMP_KTAB_NUM;
    p = lj_strfmt_wuleb128(p, o->u32.lo);
    p = lj_strfmt_wuleb128(p, o->u32.hi);
+  } else if (tvistab(o)) { /* Write the nil value marker as a nil. */
+    *p++ = BCDUMP_KTAB_NIL;
  } else {
    lj_assertBCW(tvispri(o), "unhandled type %d", itype(o));
    *p++ = BCDUMP_KTAB_NIL+~itype(o);
@@ -133,7 +135,7 @@ static void bcwrite_ktab_sorted_hash(BCWriteCtx *ctx, Node *node, MSize nhash)
  TValue **heap = ctx->heap;
  MSize i = nhash;
  for (;; node--) {  /* Build heap. */
-    if (!tvisnil(&node->key)) {
+    if (!tvisnil(&node->val)) {
      bcwrite_ktabk_heap_insert(heap, --i, nhash, &node->key);
      if (i == 0) break;
    }
@@ -163,7 +165,7 @@ static void bcwrite_ktab(BCWriteCtx *ctx, char *p, const GCtab *t)
    MSize i, hmask = t->hmask;
    Node *node = noderef(t->node);
    for (i = 0; i <= hmask; i++)
-      nhash += !tvisnil(&node[i].key);
+      nhash += !tvisnil(&node[i].val);
  }
  /* Write number of array slots and hash slots. */
  p = lj_strfmt_wuleb128(p, narray);
@@ -184,7 +186,7 @@ static void bcwrite_ktab(BCWriteCtx *ctx, char *p, const GCtab *t)
    } else {
      MSize i = nhash;
      for (;; node--)
-        if (!tvisnil(&node->key)) {
+        if (!tvisnil(&node->val)) {
          bcwrite_ktabk(ctx, &node->key, 0);
          bcwrite_ktabk(ctx, &node->val, 1);
          if (--i == 0) break;
diff --git a/src/lj_ccall.c b/src/lj_ccall.c
index ae69cd28..d5f092ea 100644
--- a/src/lj_ccall.c
+++ b/src/lj_ccall.c
@@ -781,17 +781,24 @@ static unsigned int ccall_classify_struct(CTState *cts, CType *ct)
 {
  CTSize sz = ct->size;
  unsigned int r = 0, n = 0, isu = (ct->info & CTF_UNION);
-  while (ct->sib) {
+  while (ct->sib && n <= 4) {
+    unsigned int m = 1;
    CType *sct;
    ct = ctype_get(cts, ct->sib);
    if (ctype_isfield(ct->info)) {
      sct = ctype_rawchild(cts, ct);
+      if (ctype_isarray(sct->info)) {
+        CType *cct = ctype_rawchild(cts, sct);
+        if (!cct->size) continue;
+        m = sct->size / cct->size;
+        sct = cct;
+      }
      if (ctype_isfp(sct->info)) {
        r |= sct->size;
-        if (!isu) n++; else if (n == 0) n = 1;
+        if (!isu) n += m; else if (n < m) n = m;
      } else if (ctype_iscomplex(sct->info)) {
        r |= (sct->size >> 1);
-        if (!isu) n += 2; else if (n < 2) n = 2;
+        if (!isu) n += 2*m; else if (n < 2*m) n = 2*m;
      } else if (ctype_isstruct(sct->info)) {
        goto substruct;
      } else {
@@ -803,10 +810,11 @@ static unsigned int ccall_classify_struct(CTState *cts, CType *ct)
      sct = ctype_rawchild(cts, ct);
    substruct:
      if (sct->size > 0) {
-        unsigned int s = ccall_classify_struct(cts, sct);
+        unsigned int s = ccall_classify_struct(cts, sct), sn;
        if (s <= 1) goto noth;
        r |= (s & 255);
-        if (!isu) n += (s >> 8); else if (n < (s >>8)) n = (s >> 8);
+        sn = (s >> 8) * m;
+        if (!isu) n += sn; else if (n < sn) n = sn;
      }
    }
  }
@@ -893,7 +901,9 @@ static void ccall_copy_struct(CCallState *cc, CType *ctr, void *dp, void *sp,
 /* -- Common C call handling ---------------------------------------------- */
-/* Infer the destination CTypeID for a vararg argument. */
+/* Infer the destination CTypeID for a vararg argument.
+** Note: may reallocate cts->tab and invalidate CType pointers.
+*/
 CTypeID lj_ccall_ctid_vararg(CTState *cts, cTValue *o)
 {
  if (tvisnumber(o)) {
@@ -921,13 +931,16 @@ CTypeID lj_ccall_ctid_vararg(CTState *cts, cTValue *o)
  }
 }
-/* Setup arguments for C call. */
+/* Setup arguments for C call.
+** Note: may reallocate cts->tab and invalidate CType pointers.
+*/
 static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
                          CCallState *cc)
 {
  int gcsteps = 0;
  TValue *o, *top = L->top;
  CTypeID fid;
+  CTInfo info = ct->info;  /* lj_ccall_ctid_vararg may invalidate ct pointer. */
  CType *ctr;
  MSize maxgpr, ngpr = 0, nsp = 0, narg;
 #if CCALL_NARG_FPR
@@ -946,7 +959,7 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
 #if LJ_TARGET_X86
  /* x86 has several different calling conventions. */
  cc->resx87 = 0;
-  switch (ctype_cconv(ct->info)) {
+  switch (ctype_cconv(info)) {
  case CTCC_FASTCALL: maxgpr = 2; break;
  case CTCC_THISCALL: maxgpr = 1; break;
  default: maxgpr = 0; break;
@@ -963,7 +976,7 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
  } else if (ctype_iscomplex(ctr->info) || ctype_isstruct(ctr->info)) {
    /* Preallocate cdata object and anchor it after arguments. */
    CTSize sz = ctr->size;
-    GCcdata *cd = lj_cdata_new(cts, ctype_cid(ct->info), sz);
+    GCcdata *cd = lj_cdata_new(cts, ctype_cid(info), sz);
    void *dp = cdataptr(cd);
    setcdataV(L, L->top++, cd);
    if (ctype_isstruct(ctr->info)) {
@@ -986,7 +999,7 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
  }
 #if LJ_TARGET_ARM64 && LJ_ABI_WIN
-  if ((ct->info & CTF_VARARG)) {
+  if ((info & CTF_VARARG)) {
    nsp -= maxgpr * CTSIZE_PTR;  /* May end up with negative nsp. */
    ngpr = maxgpr;
    nfpr = CCALL_NARG_FPR;
@@ -1007,7 +1020,7 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
      lj_assertL(ctype_isfield(ctf->info), "field expected");
      did = ctype_cid(ctf->info);
    } else {
-      if (!(ct->info & CTF_VARARG))
+      if (!(info & CTF_VARARG))
        lj_err_caller(L, LJ_ERR_FFI_NUMARG);  /* Too many arguments. */
      did = lj_ccall_ctid_vararg(cts, o);  /* Infer vararg type. */
      isva = 1;
@@ -1178,11 +1191,11 @@ int lj_ccall_func(lua_State *L, GCcdata *cd)
    ct = ctype_rawchild(cts, ct);
  }
  if (ctype_isfunc(ct->info)) {
+    CTypeID id = ctype_typeid(cts, ct);
    CCallState cc;
    int gcsteps, ret;
    cc.func = (void (*)(void))cdata_getptr(cdataptr(cd), sz);
    gcsteps = ccall_set_args(L, cts, ct, &cc);
-    ct = (CType *)((intptr_t)ct-(intptr_t)cts->tab);
    cts->cb.slot = ~0u;
    lj_vm_ffi_call(&cc);
    if (cts->cb.slot != ~0u) {  /* Blacklist function that called a callback. */
@@ -1190,7 +1203,7 @@ int lj_ccall_func(lua_State *L, GCcdata *cd)
      tv.u64 = ((uintptr_t)(void *)cc.func >> 2) | U64x(800000000, 00000000);
      setboolV(lj_tab_set(L, cts->miscmap, &tv), 1);
    }
-    ct = (CType *)((intptr_t)ct+(intptr_t)cts->tab);  /* May be reallocated. */
+    ct = ctype_get(cts, id);  /* Table may have been reallocated. */
    gcsteps += ccall_get_results(L, cts, ct, &cc, &ret);
 #if LJ_TARGET_X86 && LJ_ABI_WIN
    /* Automatically detect __stdcall and fix up C function declaration. */
diff --git a/src/lj_crecord.c b/src/lj_crecord.c
index f88cddfd..27f2c1dd 100644
--- a/src/lj_crecord.c
+++ b/src/lj_crecord.c
@@ -1101,12 +1101,15 @@ static void crec_alloc(jit_State *J, RecordFFData *rd, CTypeID id)
    crec_finalizer(J, trcd, 0, fin);
 }
-/* Record argument conversions. */
+/* Record argument conversions.
+** Note: may reallocate cts->tab and invalidate CType pointers.
+*/
 static TRef crec_call_args(jit_State *J, RecordFFData *rd,
                           CTState *cts, CType *ct)
 {
  TRef args[CCI_NARGS_MAX];
  CTypeID fid;
+  CTInfo info = ct->info;  /* lj_ccall_ctid_vararg may invalidate ct pointer. */
  MSize i, n;
  TRef tr, *base;
  cTValue *o;
@@ -1115,9 +1118,9 @@ static TRef crec_call_args(jit_State *J, RecordFFData *rd,
  TRef *arg0 = NULL, *arg1 = NULL;
 #endif
  int ngpr = 0;
-  if (ctype_cconv(ct->info) == CTCC_THISCALL)
+  if (ctype_cconv(info) == CTCC_THISCALL)
    ngpr = 1;
-  else if (ctype_cconv(ct->info) == CTCC_FASTCALL)
+  else if (ctype_cconv(info) == CTCC_FASTCALL)
    ngpr = 2;
 #elif LJ_TARGET_ARM64 && LJ_TARGET_OSX
  int ngpr = CCALL_NARG_GPR;
@@ -1144,7 +1147,7 @@ static TRef crec_call_args(jit_State *J, RecordFFData *rd,
      lj_assertJ(ctype_isfield(ctf->info), "field expected");
      did = ctype_cid(ctf->info);
    } else {
-      if (!(ct->info & CTF_VARARG))
+      if (!(info & CTF_VARARG))
        lj_trace_err(J, LJ_TRERR_NYICALL);  /* Too many arguments. */
 #if LJ_TARGET_ARM64 && LJ_TARGET_OSX
      if (ngpr >= 0) {
@@ -1248,14 +1251,17 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
 {
  CTState *cts = ctype_ctsG(J2G(J));
  CType *ct = ctype_raw(cts, cd->ctypeid);
+  CTInfo info;
  IRType tp = IRT_PTR;
  if (ctype_isptr(ct->info)) {
    tp = (LJ_64 && ct->size == 8) ? IRT_P64 : IRT_P32;
    ct = ctype_rawchild(cts, ct);
  }
-  if (ctype_isfunc(ct->info)) {
+  info = ct->info;  /* crec_call_args may invalidate ct pointer. */
+  if (ctype_isfunc(info)) {
    TRef func = emitir(IRT(IR_FLOAD, tp), J->base[0], IRFL_CDATA_PTR);
    CType *ctr = ctype_rawchild(cts, ct);
+    CTInfo ctr_info = ctr->info;  /* crec_call_args may invalidate ctr. */
    IRType t = crec_ct2irt(cts, ctr);
    TRef tr;
    TValue tv;
@@ -1263,22 +1269,22 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
    tv.u64 = ((uintptr_t)cdata_getptr(cdataptr(cd), (LJ_64 && tp == IRT_P64) ? 8 : 4) >> 2) | U64x(800000000, 00000000);
    if (tvistrue(lj_tab_get(J->L, cts->miscmap, &tv)))
      lj_trace_err(J, LJ_TRERR_BLACKL);
-    if (ctype_isvoid(ctr->info)) {
+    if (ctype_isvoid(ctr_info)) {
      t = IRT_NIL;
      rd->nres = 0;
-    } else if (!(ctype_isnum(ctr->info) || ctype_isptr(ctr->info) ||
+    } else if (!(ctype_isnum(ctr_info) || ctype_isptr(ctr_info) ||
-                 ctype_isenum(ctr->info)) || t == IRT_CDATA) {
+                 ctype_isenum(ctr_info)) || t == IRT_CDATA) {
      lj_trace_err(J, LJ_TRERR_NYICALL);
    }
-    if ((ct->info & CTF_VARARG)
+    if ((info & CTF_VARARG)
 #if LJ_TARGET_X86
-        || ctype_cconv(ct->info) != CTCC_CDECL
+        || ctype_cconv(info) != CTCC_CDECL
 #endif
        )
      func = emitir(IRT(IR_CARG, IRT_NIL), func,
                    lj_ir_kint(J, ctype_typeid(cts, ct)));
    tr = emitir(IRT(IR_CALLXS, t), crec_call_args(J, rd, cts, ct), func);
-    if (ctype_isbool(ctr->info)) {
+    if (ctype_isbool(ctr_info)) {
      if (frame_islua(J->L->base-1) && bc_b(frame_pc(J->L->base-1)[-1]) == 1) {
        /* Don't check result if ignored. */
        tr = TREF_NIL;
@@ -1294,8 +1300,8 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
        tr = TREF_TRUE;
      }
    } else if (t == IRT_PTR || (LJ_64 && t == IRT_P32) ||
-               t == IRT_I64 || t == IRT_U64 || ctype_isenum(ctr->info)) {
+               t == IRT_I64 || t == IRT_U64 || ctype_isenum(ctr_info)) {
-      TRef trid = lj_ir_kint(J, ctype_cid(ct->info));
+      TRef trid = lj_ir_kint(J, ctype_cid(info));
      tr = emitir(IRTG(IR_CNEWI, IRT_CDATA), trid, tr);
      if (t == IRT_I64 || t == IRT_U64) lj_needsplit(J);
    } else if (t == IRT_FLOAT || t == IRT_U32) {
diff --git a/src/lj_debug.c b/src/lj_debug.c
index b3d52afc..f9392d8e 100644
--- a/src/lj_debug.c
+++ b/src/lj_debug.c
@@ -101,6 +101,7 @@ static BCPos debug_framepc(lua_State *L, GCfunc *fn, cTValue *nextframe)
  pt = funcproto(fn);
  pos = proto_bcpos(pt, ins) - 1;
 #if LJ_HASJIT
+  if (pos == NO_BCPOS) return 1;  /* Pretend it's the first bytecode. */
  if (pos > pt->sizebc) {  /* Undo the effects of lj_trace_exit for JLOOP. */
    if (bc_isret(bc_op(ins[-1]))) {
      GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins));
diff --git a/src/lj_load.c b/src/lj_load.c
index 828bf8ae..24b660a8 100644
--- a/src/lj_load.c
+++ b/src/lj_load.c
@@ -122,8 +122,9 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename,
    copyTV(L, L->top-1, L->top);
  }
  if (err) {
+    const char *fname = filename ? filename : "stdin";
    L->top--;
-    lua_pushfstring(L, "cannot read %s: %s", chunkname+1, strerror(err));
+    lua_pushfstring(L, "cannot read %s: %s", fname, strerror(err));
    return LUA_ERRFILE;
  }
  return status;
diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c
index 36aacebb..6fdf4566 100644
--- a/src/lj_opt_fold.c
+++ b/src/lj_opt_fold.c
@@ -2217,9 +2217,11 @@ LJFOLD(HREF TDUP KNUM)
 LJFOLDF(fwd_href_tdup)
 {
  TValue keyv;
+  cTValue *val;
  lj_ir_kvalue(J->L, &keyv, fright);
-  if (lj_tab_get(J->L, ir_ktab(IR(fleft->op1)), &keyv) == niltvg(J2G(J)) &&
+  val = lj_tab_get(J->L, ir_ktab(IR(fleft->op1)), &keyv);
-      lj_opt_fwd_href_nokey(J))
+  /* Check for either nil or the nil value marker in the template table. */
+  if ((tvisnil(val) || tvistab(val)) && lj_opt_fwd_href_nokey(J))
    return lj_ir_kkptr(J, niltvg(J2G(J)));
  return NEXTFOLD;
 }
diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 8cacfcfe..6f956b37 100644
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -233,7 +233,9 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)
          return lj_ir_knum_u64(J, tv->u64);
        else if (tvisint(tv))
          return lj_ir_kint(J, intV(tv));
-        else if (tvisgcv(tv))
+        else if (tvistab(tv)) /* Template table nil value marker. */
+          return TREF_NIL;
+        else if (tvisstr(tv))
          return lj_ir_kstr(J, strV(tv));
      }
      /* Othwerwise: don't intern as a constant. */
diff --git a/src/lj_parse.c b/src/lj_parse.c
index 70097598..e326432a 100644
--- a/src/lj_parse.c
+++ b/src/lj_parse.c
@@ -1517,23 +1517,11 @@ static void fs_fixup_var(LexState *ls, GCproto *pt, uint8_t *p, size_t ofsvar)
 #endif
-/* Check if bytecode op returns. */
-static int bcopisret(BCOp op)
-{
-  switch (op) {
-  case BC_CALLMT: case BC_CALLT:
-  case BC_RETM: case BC_RET: case BC_RET0: case BC_RET1:
-    return 1;
-  default:
-    return 0;
-  }
-}
 /* Fixup return instruction for prototype. */
 static void fs_fixup_ret(FuncState *fs)
 {
  BCPos lastpc = fs->pc;
-  if (lastpc <= fs->lasttarget || !bcopisret(bc_op(fs->bcbase[lastpc-1].ins))) {
+  if (lastpc <= fs->lasttarget || !bc_isret_or_tail(bc_op(fs->bcbase[lastpc-1].ins))) {
    if ((fs->bl->flags & FSCOPE_UPVAL))
      bcemit_AJ(fs, BC_UCLO, 0, 0);
    bcemit_AD(fs, BC_RET0, 0, 1);  /* Need final return. */
@@ -1725,7 +1713,7 @@ static void expr_table(LexState *ls, ExpDesc *e)
  FuncState *fs = ls->fs;
  BCLine line = ls->linenumber;
  GCtab *t = NULL;
-  int vcall = 0, needarr = 0, fixt = 0;
+  int vcall = 0, needarr = 0;
  uint32_t narr = 1;  /* First array index. */
  uint32_t nhash = 0;  /* Number of hash entries. */
  BCReg freg = fs->freereg;
@@ -1769,9 +1757,10 @@ static void expr_table(LexState *ls, ExpDesc *e)
      lj_gc_anybarriert(fs->L, t);
      if (expr_isk_nojump(&val)) {  /* Add const key/value to template table. */
        expr_kvalue(fs, v, &val);
-      } else {  /* Otherwise create dummy string key (avoids lj_tab_newkey). */
+        /* Mark nil value with table value itself to preserve the key. */
-        settabV(fs->L, v, t);  /* Preserve key with table itself as value. */
+        if (key.k == VKSTR && tvisnil(v)) settabV(fs->L, v, t);
-        fixt = 1;   /* Fix this later, after all resizes. */
+      } else {  /* Preserve the key for the following non-const store.  */
+        settabV(fs->L, v, t);
        goto nonconst;
      }
    } else {
@@ -1813,17 +1802,6 @@ static void expr_table(LexState *ls, ExpDesc *e)
  } else {
    if (needarr && t->asize < narr)
      lj_tab_reasize(fs->L, t, narr-1);
-    if (fixt) {  /* Fix value for dummy keys in template table. */
-      Node *node = noderef(t->node);
-      uint32_t i, hmask = t->hmask;
-      for (i = 0; i <= hmask; i++) {
-        Node *n = &node[i];
-        if (tvistab(&n->val)) {
-          lj_assertFS(tabV(&n->val) == t, "bad dummy key in template table");
-          setnilV(&n->val);  /* Turn value into nil. */
-        }
-      }
-    }
    lj_gc_check(fs->L);
  }
 }
diff --git a/src/lj_record.c b/src/lj_record.c
index c6a082d4..6543f274 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -973,7 +973,8 @@ void lj_record_ret(jit_State *J, BCReg rbase, ptrdiff_t gotresults)
      lj_trace_err(J, LJ_TRERR_LLEAVE);
    } else if (J->needsnap) {  /* Tailcalled to ff with side-effects. */
      lj_trace_err(J, LJ_TRERR_NYIRETL);  /* No way to insert snapshot here. */
-    } else if (1 + pt->framesize >= LJ_MAX_JSLOTS) {
+    } else if (1 + pt->framesize >= LJ_MAX_JSLOTS ||
+               J->baseslot + J->maxslot >= LJ_MAX_JSLOTS) {
      lj_trace_err(J, LJ_TRERR_STACKOV);
    } else {  /* Return to lower frame. Guard for the target we return to. */
      TRef trpt = lj_ir_kgc(J, obj2gco(pt), IRT_PROTO);
@@ -1107,7 +1108,10 @@ int lj_record_mm_lookup(jit_State *J, RecordIndex *ix, MMS mm)
      return 0;  /* No metamethod. */
    }
    /* The cdata metatable is treated as immutable. */
-    if (LJ_HASFFI && tref_iscdata(ix->tab)) goto immutable_mt;
+    if (LJ_HASFFI && tref_iscdata(ix->tab)) {
+      mix.tab = TREF_NIL;
+      goto immutable_mt;
+    }
    ix->mt = mix.tab = lj_ir_ggfload(J, IRT_TAB,
      GG_OFS(g.gcroot[GCROOT_BASEMT+itypemap(&ix->tabv)]));
    goto nocheck;
diff --git a/src/lj_snap.c b/src/lj_snap.c
index cb104439..d0d28c81 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -956,8 +956,10 @@ const BCIns *lj_snap_restore(jit_State *J, void *exptr)
  const BCIns *pc = snap_pc(&map[nent]);
  lua_State *L = J->L;
-  /* Set interpreter PC to the next PC to get correct error messages. */
+  /* Set interpreter PC to the next PC to get correct error messages.
-  setcframe_pc(L->cframe, pc+1);
+  ** But not for returns or tail calls, since pc+1 may be out-of-range.
+  */
+  setcframe_pc(L->cframe, bc_isret_or_tail(bc_op(*pc)) ? pc : pc+1);
  setcframe_pc(cframe_raw(cframe_prev(L->cframe)), pc);
  /* Make sure the stack is big enough for the slots from the snapshot. */
diff --git a/src/lj_tab.c b/src/lj_tab.c
index 2d080552..62e33611 100644
--- a/src/lj_tab.c
+++ b/src/lj_tab.c
@@ -194,6 +194,7 @@ GCtab * LJ_FASTCALL lj_tab_dup(lua_State *L, const GCtab *kt)
      Node *next = nextnode(kn);
      /* Don't use copyTV here, since it asserts on a copy of a dead key. */
      n->val = kn->val; n->key = kn->key;
+      if (tvistab(&n->val)) setnilV(&n->val); /* Replace nil value marker. */
      setmref(n->next, next == NULL? next : (Node *)((char *)next + d));
    }
  }
diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
index 69c0c61a..d6aed170 100644
--- a/src/msvcbuild.bat
+++ b/src/msvcbuild.bat
@@ -5,11 +5,12 @@
 @rem Then cd to this directory and run this script. Use the following
 @rem options (in order), if needed. The default is a dynamic release build.
 @rem
-@rem   nogc64   disable LJ_GC64 mode for x64
+@rem   nogc64        disable LJ_GC64 mode for x64
-@rem   debug    emit debug symbols
+@rem   debug         emit debug symbols
-@rem   amalg    amalgamated build
+@rem   lua52compat   enable extra Lua 5.2 extensions
-@rem   static   create static lib to statically link into your project
+@rem   amalg         amalgamated build
-@rem   mixed    create static lib to build a DLL in your project
+@rem   static        create static lib to statically link into your project
+@rem   mixed         create static lib to build a DLL in your project
 @if not defined INCLUDE goto :FAIL
@@ -101,6 +102,10 @@ buildvm -m folddef -o lj_folddef.h lj_opt_fold.c
 @set LJDYNBUILD=%LJDYNBUILD_DEBUG%
 @set LJLINKTYPE=%LJLINKTYPE_DEBUG%
 :NODEBUG
+@if "%1" neq "lua52compat" goto :NOLUA52COMPAT
+@shift
+@set LJCOMPILE=%LJCOMPILE% /DLUAJIT_ENABLE_LUA52COMPAT
+:NOLUA52COMPAT
 @set LJCOMPILE=%LJCOMPILE% %LJCOMPILETARGET%
 @set LJLINK=%LJLINK% %LJLINKTYPE% %LJLINKTARGET%
 @if "%1"=="amalg" goto :AMALGDLL
diff --git a/src/vm_arm.dasc b/src/vm_arm.dasc
index ca08fc11..86bef0cf 100644
--- a/src/vm_arm.dasc
+++ b/src/vm_arm.dasc
@@ -1717,8 +1717,8 @@ static void build_subroutines(BuildCtx *ctx)
  |.endif
  |.endmacro
  |
-  |  math_minmax math_min, gt, pl
+  |  math_minmax math_min, gt, hs
-  |  math_minmax math_max, lt, le
+  |  math_minmax math_max, lt, ls
  |
  |//-- String library -----------------------------------------------------
  |