From 9f452bbef5031afc506d8615f5e720c45acd6fdf Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Fri, 2 Jun 2023 11:38:45 +0200
Subject: Fix handling of instable types in TNEW/TDUP load forwarding.

Analyzed by Sergey Kaplun. #994
---
 src/lj_opt_mem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 5b1ad898..9d83ea4a 100644
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -197,7 +197,8 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)
 	if (key->o == IR_KSLOT) key = IR(key->op1);
 	lj_ir_kvalue(J->L, &keyv, key);
 	tv = lj_tab_get(J->L, ir_ktab(IR(ir->op1)), &keyv);
-	lua_assert(itype2irt(tv) == irt_type(fins->t));
+	if (itype2irt(tv) != irt_type(fins->t))
+	  return 0;  /* Type instability in loop-carried dependency. */
 	if (irt_isnum(fins->t))
 	  return lj_ir_knum_u64(J, tv->u64);
 	else if (LJ_DUALNUM && irt_isint(fins->t))
-- 
cgit v1.2.3-55-g6feb