From fed6d4782a3939d0b260402e2df5706ca036a290 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Thu, 9 Jul 2026 10:24:06 +0200
Subject: Don't use destroyed lock when profiler has been stopped.

Reported by Miku AuahDark. #1482 #1460
---
 src/lj_profile.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lj_profile.c b/src/lj_profile.c
index 5b2a2b6c7..ea65fcb8f 100644
--- a/src/lj_profile.c
+++ b/src/lj_profile.c
@@ -359,6 +359,7 @@ LUA_API void luaJIT_profile_stop(lua_State *L)
   ProfileState *ps = &profile_state;
   global_State *g = ps->g;
   if (G(L) == g) {  /* Only stop profiler if started by this VM. */
+    ps->g = NULL;
     profile_timer_stop(ps);
     g->hookmask &= ~HOOK_PROFILE;
     lj_dispatch_update(g, 0);
@@ -368,7 +369,6 @@ LUA_API void luaJIT_profile_stop(lua_State *L)
 #endif
     lj_buf_free(g, &ps->sb);
     ps->sb.w = ps->sb.e = NULL;
-    ps->g = NULL;
   }
 }
 
-- 
cgit v1.2.3-55-g6feb


From 5dd996ece5aa20087e37cb8c471aec1f88ca5ca2 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Fri, 10 Jul 2026 10:38:55 +0200
Subject: DynASM/x86: Fix insertps instruction encoding.

Thanks to Dmitry Stogov. #1483
---
 dynasm/dasm_x86.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dynasm/dasm_x86.lua b/dynasm/dasm_x86.lua
index 0794e1804..a24570e0a 100644
--- a/dynasm/dasm_x86.lua
+++ b/dynasm/dasm_x86.lua
@@ -1409,7 +1409,7 @@ local map_op = {
   dppd_3 =	"rmio:660F3A41rMU",
   dpps_3 =	"rmio:660F3A40rMU",
   extractps_3 =	"mri/do:660F3A17RmU|rri/qo:660F3A17RXmU",
-  insertps_3 =	"rrio:660F3A41rMU|rxi/od:",
+  insertps_3 =	"rrio:660F3A21rMU|rxi/od:",
   movntdqa_2 =	"rxo:660F382ArM",
   mpsadbw_3 =	"rmio:660F3A42rMU",
   packusdw_2 =	"rmo:660F382BrM",
-- 
cgit v1.2.3-55-g6feb


From 859ad934bc3b92125043c3e599492aecd3586992 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Sat, 11 Jul 2026 14:37:49 +0200
Subject: x64: Fix callback result handling.

Reported by Matt Gerassimoff.
---
 src/lj_ccallback.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/lj_ccallback.c b/src/lj_ccallback.c
index 3ddb7ca5c..2fa8e7ce0 100644
--- a/src/lj_ccallback.c
+++ b/src/lj_ccallback.c
@@ -519,6 +519,10 @@ static void callback_conv_result(CTState *cts, lua_State *L, TValue *o)
 #if LJ_TARGET_X86
     if (ctype_isfp(ctr->info))
       cts->cb.gpr[2] = ctr->size == sizeof(float) ? 1 : 2;
+#elif LJ_TARGET_X64
+    /* Always zero-extend results to 64 bits. */
+    if (ctr->size <= 4 && ctype_isinteger_or_bool(ctr->info))
+      *(uint64_t *)dp = (uint64_t)*(uint32_t *)dp;
 #endif
   }
 }
-- 
cgit v1.2.3-55-g6feb


From 14d8a7a27dc8c626ab9e7c7e9e50b6df6def4f03 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Sat, 18 Jul 2026 09:48:48 +0200
Subject: x64/LJ_GC64: Avoid store-to-load forwarding stall after stack
 restore.

Thanks to Sergey Kaplun. #1485
---
 src/lj_asm_x86.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 943cf2b77..3c024092c 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -1112,10 +1112,12 @@ static void asm_tvptr(ASMState *as, Reg dest, IRRef ref, MSize mode)
     } else {
 #if LJ_GC64
       if (irref_isk(ref)) {
+	Reg tmp;
 	TValue k;
 	lj_ir_kvalue(as->J->L, &k, ir);
-	emit_movmroi(as, dest, 4, k.u32.hi);
-	emit_movmroi(as, dest, 0, k.u32.lo);
+	tmp = ra_scratch(as, rset_exclude(RSET_GPR, dest));
+	emit_rmro(as, XO_MOVto, tmp|REX_64, dest, 0);
+	emit_loadu64(as, tmp, k.u64);
       } else {
 	/* TODO: 64 bit store + 32 bit load-modify-store is suboptimal. */
 	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPR, dest));
@@ -2787,8 +2789,9 @@ static void asm_stack_restore(ASMState *as, SnapShot *snap)
 	  emit_i32(as, -1);
 	  emit_rmro(as, XO_MOVmi, REX_64, RID_BASE, ofs);
 	} else {
-	  emit_movmroi(as, RID_BASE, ofs+4, k.u32.hi);
-	  emit_movmroi(as, RID_BASE, ofs, k.u32.lo);
+	  Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, RID_BASE));
+	  emit_rmro(as, XO_MOVto, tmp|REX_64, RID_BASE, ofs);
+	  emit_loadu64(as, tmp, k.u64);
 	}
 #else
       } else if (!irt_ispri(ir->t)) {
-- 
cgit v1.2.3-55-g6feb