Fix predict_next() in parser (again).

Reported by Sergey Bronnikov. #1054

diff --git a/src/lj_parse.c b/src/lj_parse.c
index c0cbd261c98452a191c79dc8dd5ea5845565c477..afdbcc3d5f3cdac2ef3e65abeff81567658a8f1a 100644 (file)
--- a/src/lj_parse.c
+++ b/src/lj_parse.c
@@ -2527,9 +2527,11 @@ static void parse_for_num(LexState *ls, GCstr *varname, BCLine line)
 */
 static int predict_next(LexState *ls, FuncState *fs, BCPos pc)
 {
-  BCIns ins = fs->bcbase[pc].ins;
+  BCIns ins;
   GCstr *name;
   cTValue *o;
+  if (pc >= fs->bclim) return 0;
+  ins = fs->bcbase[pc].ins;
   switch (bc_op(ins)) {
   case BC_MOV:
     if (bc_d(ins) >= fs->nactvar) return 0;