Merge branch 'master' into v2.1

diff --cc src/lj_snap.c
index 68de208f4471cdf37a981b8e9516e672ac4bace1,5a5c481bc1285544c2b3d442c2f9557b983c6f9b..93eb8a29196c5cc94915ba529183cf147163d71b
--- 1/src/lj_snap.c
--- 2/src/lj_snap.c
+++ b/src/lj_snap.c
@@@ -624,6 -575,17 +624,21 @@@ void lj_snap_replay(jit_State *J, GCtra
                if (irr->o == IR_HREFK || irr->o == IR_AREF) {
                  IRIns *irf = &T->ir[irr->op1];
                  tmp = emitir(irf->ot, tmp, irf->op2);
 -                lua_assert(irref_isk(keyref));
+               } else if (irr->o == IR_NEWREF) {
+                 IRRef allocref = tref_ref(tr);
+                 IRRef keyref = tref_ref(key);
+                 IRRef newref_ref = J->chain[IR_NEWREF];
+                 IRIns *newref = &J->cur.ir[newref_ref];
 -                  lua_assert(newref->op1 == allocref);
++                lj_assertJ(irref_isk(keyref),
++                           "sunk store for parent IR %04d with bad key %04d",
++                           refp - REF_BIAS, keyref - REF_BIAS);
+                 if (newref_ref > allocref && newref->op2 == keyref) {
++                  lj_assertJ(newref->op1 == allocref,
++                             "sunk store for parent IR %04d with bad tab %04d",
++                             refp - REF_BIAS, allocref - REF_BIAS);
+                   tmp = newref_ref;
+                   goto skip_newref;
+                 }
                }
              }
              tmp = emitir(irr->ot, tmp, key);