From d4c0c6e17ef7edf1f2893bc807746b80612e63e9 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Thu, 9 May 2019 11:33:03 +0200
Subject: [PATCH] Fix TNEW load forwarding with instable types.

---
 src/lj_opt_mem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 9f714056..f7833654 100644
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -179,7 +179,8 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)
 	}
 	ref = store->prev;
       }
-      lua_assert(ir->o != IR_TNEW || irt_isnil(fins->t));
+      if (ir->o == IR_TNEW && !irt_isnil(fins->t))
+	return 0;  /* Type instability in loop-carried dependency. */
       if (irt_ispri(fins->t)) {
 	return TREF_PRI(irt_type(fins->t));
       } else if (irt_isnum(fins->t) || (LJ_DUALNUM && irt_isint(fins->t)) ||