Merge branch 'master' into v2.1

diff --cc src/lj_snap.c
index 93eb8a29196c5cc94915ba529183cf147163d71b,b387dd76cfd68f8a4b89300a29bf86c6843d9ea0..7d7347a1b2f82e26f08b209467d5e12e98dcfca8
--- 1/src/lj_snap.c
--- 2/src/lj_snap.c
+++ b/src/lj_snap.c
@@@ -557,13 -510,14 +557,15 @@@ void lj_snap_replay(jit_State *J, GCtra
        IRRef refp = snap_ref(sn);
        IRIns *ir = &T->ir[refp];
        if (regsp_reg(ir->r) == RID_SUNK) {
+       uint8_t m;
        if (J->slot[snap_slot(sn)] != snap_slot(sn)) continue;
        pass23 = 1;
 -      lua_assert(ir->o == IR_TNEW || ir->o == IR_TDUP ||
 -                 ir->o == IR_CNEW || ir->o == IR_CNEWI);
 +      lj_assertJ(ir->o == IR_TNEW || ir->o == IR_TDUP ||
 +                 ir->o == IR_CNEW || ir->o == IR_CNEWI,
 +                 "sunk parent IR %04d has bad op %d", refp - REF_BIAS, ir->o);
-       if (ir->op1 >= T->nk) snap_pref(J, T, map, nent, seen, ir->op1);
-       if (ir->op2 >= T->nk) snap_pref(J, T, map, nent, seen, ir->op2);
+       m = lj_ir_mode[ir->o];
+       if (irm_op1(m) == IRMref) snap_pref(J, T, map, nent, seen, ir->op1);
+       if (irm_op2(m) == IRMref) snap_pref(J, T, map, nent, seen, ir->op2);
        if (LJ_HASFFI && ir->o == IR_CNEWI) {
          if (LJ_32 && refp+1 < T->nins && (ir+1)->o == IR_HIOP)
            snap_pref(J, T, map, nent, seen, (ir+1)->op2);