Fix TNEW load forwarding with instable types.

diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 9f71405629082b8cd0e46e3be69d6f1653fc7774..f7833654eb99f42ed2e0d7ef98d01ce6befcbf47 100644 (file)
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -179,7 +179,8 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)
        }
        ref = store->prev;
       }
-      lua_assert(ir->o != IR_TNEW || irt_isnil(fins->t));
+      if (ir->o == IR_TNEW && !irt_isnil(fins->t))
+       return 0;  /* Type instability in loop-carried dependency. */
       if (irt_ispri(fins->t)) {
        return TREF_PRI(irt_type(fins->t));
       } else if (irt_isnum(fins->t) || (LJ_DUALNUM && irt_isint(fins->t)) ||