Only replay sunk stores up to the snapshot reference.

diff --git a/src/lj_snap.c b/src/lj_snap.c
index 0cf12243bb9739121e32c48c81d5ca9f240c6074..dd123692d3ab71eac898aa3a409b2cbfc23f363e 100644 (file)
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -464,8 +464,7 @@ void lj_snap_replay(jit_State *J, GCtrace *T)
       J->baseslot = s+1;
   }
   if (pass23) {
-    IRIns *irlast = &T->ir[(snap+1)->ref];
-    lua_assert(J->exitno+1 < T->nsnap);
+    IRIns *irlast = &T->ir[snap->ref];
     pass23 = 0;
     /* Emit dependent PVALs. */
     for (n = 0; n < nent; n++) {