Fix limit check in narrow_conv_backprop().

Thanks to Sergey Kaplun. #1262

diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index 700c23d4a0f33cca1e99b152c089f18906560a9a..2f02407c58d3a628898752402741889f621ae253 100644 (file)
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -341,7 +341,8 @@ static int narrow_conv_backprop(NarrowConv *nc, IRRef ref, int depth)
       NarrowIns *savesp = nc->sp;
       int count = narrow_conv_backprop(nc, ir->op1, depth);
       count += narrow_conv_backprop(nc, ir->op2, depth);
-      if (count <= 1) {  /* Limit total number of conversions. */
+      /* Limit total number of conversions. */
+      if (count <= 1 && nc->sp < nc->maxsp) {
        *nc->sp++ = NARROWINS(IRT(ir->o, nc->t), ref);
        return count;
       }