diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 7931ffb5..1b94371e 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -1247,14 +1247,15 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge)
       } else {
 	emit_rr(as, XO_MOV, tmp, key);
 #if LJ_GC64
-       emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15);
-       if ((as->flags & JIT_F_BMI2)) {
-	 emit_i8(as, 32);
-	 emit_mrm(as, XV_RORX|VEX_64, dest, key);
-       } else {
-	 emit_shifti(as, XOg_SHR|REX_64, dest, 32);
-	 emit_rr(as, XO_MOV, dest|REX_64, key|REX_64);
-       }
+	checkmclim(as);
+	emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15);
+	if ((as->flags & JIT_F_BMI2)) {
+	  emit_i8(as, 32);
+	  emit_mrm(as, XV_RORX|VEX_64, dest, key);
+	} else {
+	  emit_shifti(as, XOg_SHR|REX_64, dest, 32);
+	  emit_rr(as, XO_MOV, dest|REX_64, key|REX_64);
+	}
 #else
 	emit_rmro(as, XO_LEA, dest, key, HASH_BIAS);
 #endif
diff --git a/src/lj_record.c b/src/lj_record.c
index a858ffa9..448db0cf 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -2263,6 +2263,8 @@ void lj_record_ins(jit_State *J)
     rc = lj_ir_kint(J, (int32_t)(int16_t)rc);
     break;
   case BC_KNIL:
+    if (LJ_FR2 && ra > J->maxslot)
+      J->base[ra-1] = 0;
     while (ra <= rc)
       J->base[ra++] = TREF_NIL;
     if (rc >= J->maxslot) J->maxslot = rc+1;