From e45fd4cb713b610506213692f3b55a1869febb03 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Sat, 24 Aug 2024 17:11:45 +0200
Subject: [PATCH] Fix limit check in narrow_conv_backprop().

Thanks to Sergey Kaplun. #1262
---
 src/lj_opt_narrow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index 700c23d4..2f02407c 100644
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -341,7 +341,8 @@ static int narrow_conv_backprop(NarrowConv *nc, IRRef ref, int depth)
       NarrowIns *savesp = nc->sp;
       int count = narrow_conv_backprop(nc, ir->op1, depth);
       count += narrow_conv_backprop(nc, ir->op2, depth);
-      if (count <= 1) {  /* Limit total number of conversions. */
+      /* Limit total number of conversions. */
+      if (count <= 1 && nc->sp < nc->maxsp) {
 	*nc->sp++ = NARROWINS(IRT(ir->o, nc->t), ref);
 	return count;
       }