Fix handling of number constants in snapshots in SPLIT pass.

lib/dump.lua

@@ -321,13 +321,11 @@ local function printsnap(tr, snap)
       local ref = band(sn, 0xffff) - 0x8000 -- REF_BIAS
       if ref < 0 then
 	out:write(formatk(tr, ref))
+      elseif band(sn, 0x80000) ~= 0 then -- SNAP_SOFTFPNUM
+	out:write(colorize(format("%04d/%04d", ref, ref+1), 14))
       else
-	if band(sn, 0x80000) ~= 0 then -- SNAP_SOFTFPNUM
-	  out:write(colorize(format("%04d/%04d", ref, ref+1), 14))
-	else
-	  local m, ot, op1, op2 = traceir(tr, ref)
-	  out:write(colorize(format("%04d", ref), band(ot, 31)))
-	end
+	local m, ot, op1, op2 = traceir(tr, ref)
+	out:write(colorize(format("%04d", ref), band(ot, 31)))
       end
       out:write(band(sn, 0x10000) == 0 and " " or "|") -- SNAP_FRAME
     else

src/lj_opt_split.c

@@ -255,8 +255,10 @@ static void split_ir(jit_State *J)
 	    if (irm12->op1 > J->loopref && irl1->o == IR_CALLN &&
 		irl1->op2 == IRCALL_log2) {
 	      IRRef tmp = irl1->op1;  /* Recycle first two args from LOG2. */
-	      tmp = split_emit(J, IRT(IR_CARG, IRT_NIL), tmp, irm3->op2);
-	      tmp = split_emit(J, IRT(IR_CARG, IRT_NIL), tmp, irm4->op2);
+	      IRRef arg3 = irm3->op2, arg4 = irm4->op2;
+	      J->cur.nins--;
+	      tmp = split_emit(J, IRT(IR_CARG, IRT_NIL), tmp, arg3);
+	      tmp = split_emit(J, IRT(IR_CARG, IRT_NIL), tmp, arg4);
 	      ir->prev = tmp = split_emit(J, IRTI(IR_CALLN), tmp, IRCALL_pow);
 	      hi = split_emit(J, IRT(IR_HIOP, LJ_SOFTFP), tmp, tmp);
 	      break;
@@ -278,7 +280,7 @@ static void split_ir(jit_State *J)
 			hisubst[ir->op1], hisubst[ir->op2]);
 	break;
       case IR_SLOAD: case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
-      case IR_MIN: case IR_MAX:
+      case IR_MIN: case IR_MAX: case IR_STRTO:
 	hi = split_emit(J, IRT(IR_HIOP, IRT_SOFTFP), nref, nref);
 	break;
       case IR_XLOAD:
@@ -581,7 +583,12 @@ static void split_ir(jit_State *J)
       snap->ref = oir[snap->ref].prev;
       for (n = 0; n < nent; n++) {
 	SnapEntry sn = map[n];
-	map[n] = ((sn & 0xffff0000) | oir[snap_ref(sn)].prev);
+	IRIns *ir = &oir[snap_ref(sn)];
+	if (LJ_SOFTFP && (sn & SNAP_SOFTFPNUM) && irref_isk(snap_ref(sn)))
+	  map[n] = ((sn & 0xffff0000) |
+		    (IRRef1)lj_ir_k64(J, IR_KNUM, ir_knum(ir)));
+	else
+	  map[n] = ((sn & 0xffff0000) | ir->prev);
       }
     }
   }

src/lj_snap.c

@@ -72,7 +72,7 @@ static MSize snapshot_slots(jit_State *J, SnapEntry *map, BCReg nslots)
 	    (ir->op2 & (IRSLOAD_READONLY|IRSLOAD_PARENT)) != IRSLOAD_PARENT)
 	  sn |= SNAP_NORESTORE;
       }
-      if (LJ_SOFTFP && !irref_isk(ref) && irt_isnum(ir->t))
+      if (LJ_SOFTFP && irt_isnum(ir->t))
 	sn |= SNAP_SOFTFPNUM;
       map[n++] = sn;
     }
@@ -316,7 +316,8 @@ void lj_snap_regspmap(uint16_t *rsmap, GCtrace *T, SnapNo snapno, int hi)
   for (n = 0; n < nent; n++) {
     SnapEntry sn = map[n];
     IRRef ref = snap_ref(sn);
-    if ((LJ_SOFTFP && hi) ? (ref++, (sn & SNAP_SOFTFPNUM)) : !irref_isk(ref)) {
+    if (!irref_isk(ref) &&
+	((LJ_SOFTFP && hi) ? (ref++, (sn & SNAP_SOFTFPNUM)) : 1)) {
       IRIns *ir = &T->ir[ref];
       uint32_t rs = ir->prev;
       if (bloomtest(rfilt, ref))