Another buglet in 5.1w6

[Rici Lake <lua@...>]

ldebug.c, around line 392:

      case OP_TFORLOOP: {
        check(c >= 1);  /* at least one result (control variable) */
        checkreg(pt, a+3+c);  /* space for results */
        if (reg >= a+3) last = pc;  /* affect all regs above its call 
base */
        break;
      }

The test ought to be a+2+c, not a+3+c (function, obj, state + nvars)

This is the shortest demonstration I came up with:

rlake@freeb:~/src/comprehensions/lua-5.1-work6$ src/luac -l -l -
function foo(a)
for k,v,w in a do end
end
Assertion failed: (luaG_checkcode(f)), function close_func, file 
lparser.c, line 390.
Abort trap (core dumped)

Although that shows an assert failure, it is actually visible without 
lua_assert being enabled; trying to load a compiled version of the 
little code snippet above yields a "bad code" error.

If the in clause had been any more complex, or there had been something 
in the body of the do loop, it would have needed more control variables 
to trigger the assert. Here's the generated code, without the assert:

function <stdin:1,3> (6 instructions, 24 bytes at 0x8067100)
1 param, 7 stacks, 0 upvalues, 7 locals, 0 constants, 0 functions
        1       [2]     MOVE            1 0
        2       [2]     LOADNIL         2 3
        3       [2]     JMP             0       ; to 4
        4       [2]     TFORLOOP        1 3
        5       [2]     JMP             -2      ; to 4
        6       [3]     RETURN          0 1

The error is triggered at line 4: a+3+c = 1+3+3 = 7.