From bc9261a34ae4d07d9a8cc8ea534067f523b920b8 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Tue, 13 Oct 2026 12:35:09 +0200
Subject: [PATCH] Don't record for loops with +-0 step.

Thanks to t0suj4. #1432 #1433 #1438 #1526
---
 src/lj_record.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/lj_record.c b/src/lj_record.c
index 1f0b8e22..285b1c81 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -447,9 +447,9 @@ static void rec_for_check(jit_State *J, IRType t, int dir,
 			  TRef stop, TRef step, int init)
 {
   if (!tref_isk(step)) {
-    /* Non-constant step: need a guard for the direction. */
+    /* Non-constant step: need a guard for the direction (excluding +-0). */
     TRef zero = (t == IRT_INT) ? lj_ir_kint(J, 0) : lj_ir_knum_zero(J);
-    emitir(IRTG(dir ? IR_GE : IR_LT, t), step, zero);
+    emitir(IRTG(dir ? IR_GT : IR_LT, t), step, zero);
     /* Add hoistable overflow checks for a narrowed FORL index. */
     if (init && t == IRT_INT) {
       if (tref_isk(stop)) {
@@ -530,8 +530,9 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl)
   /* Avoid semantic mismatches and always failing guards. */
   if ((tvisnum(&tv[FORL_IDX]) && tvisnan(&tv[FORL_IDX])) ||
       (tvisnum(&tv[FORL_STOP]) && tvisnan(&tv[FORL_STOP])) ||
-      (tvisnum(&tv[FORL_STEP]) && tvisnan(&tv[FORL_STEP])) ||
-      tvismzero(&tv[FORL_STEP]))
+      (tvisnum(&tv[FORL_STEP]) &&
+       (tvisnan(&tv[FORL_STEP]) || tviszero(&tv[FORL_STEP]))) ||
+      (tvisint(&tv[FORL_STEP]) && intV(&tv[FORL_STEP]) == 0))
     lj_trace_err(J, LJ_TRERR_GFAIL);
   if (isforl) {  /* Handle FORL/JFORL opcodes. */
     TRef idx = tr[FORL_IDX];