From af9763a50da87ff8ba16e828cbd5664135e05a88 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Fri, 14 Nov 2025 20:15:44 +0100
Subject: Fix edge cases when generating IR for string.byte/sub/find.

Contributed by XmiliaH. #1407
---
 src/lj_ffrecord.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c
index e22d8da6..7d83396b 100644
--- a/src/lj_ffrecord.c
+++ b/src/lj_ffrecord.c
@@ -697,7 +697,7 @@ static void LJ_FASTCALL recff_string_range(jit_State *J, RecordFFData *rd)
       emitir(IRTGI(IR_EQ), trstart, tr0);
       trstart = tr0;
     } else {
-      trstart = emitir(IRTI(IR_ADD), trstart, lj_ir_kint(J, -1));
+      trstart = emitir(IRTGI(IR_ADDOV), trstart, lj_ir_kint(J, -1));
       emitir(IRTGI(IR_GE), trstart, tr0);
       start--;
     }
@@ -705,7 +705,7 @@ static void LJ_FASTCALL recff_string_range(jit_State *J, RecordFFData *rd)
   if (rd->data) {  /* Return string.sub result. */
     if (end - start >= 0) {
       /* Also handle empty range here, to avoid extra traces. */
-      TRef trptr, trslen = emitir(IRTI(IR_SUB), trend, trstart);
+      TRef trptr, trslen = emitir(IRTGI(IR_SUBOV), trend, trstart);
       emitir(IRTGI(IR_GE), trslen, tr0);
       trptr = emitir(IRT(IR_STRREF, IRT_P32), trstr, trstart);
       J->base[0] = emitir(IRT(IR_SNEW, IRT_STR), trptr, trslen);
@@ -716,7 +716,7 @@ static void LJ_FASTCALL recff_string_range(jit_State *J, RecordFFData *rd)
   } else {  /* Return string.byte result(s). */
     ptrdiff_t i, len = end - start;
     if (len > 0) {
-      TRef trslen = emitir(IRTI(IR_SUB), trend, trstart);
+      TRef trslen = emitir(IRTGI(IR_SUBOV), trend, trstart);
       emitir(IRTGI(IR_EQ), trslen, lj_ir_kint(J, (int32_t)len));
       if (J->baseslot + len > LJ_MAX_JSLOTS)
 	lj_trace_err_info(J, LJ_TRERR_STACKOV);
-- 
cgit v1.2.3-55-g6feb