Created attachment 625406 [details] Testcase for shell The attached testcase asserts on ionmonkey revision 890dd17b4187 (run with --ion -n -m --ion-eager).
Works for me at revision 9602aebd7e43a27f1675ca8313b80045c383c7fb.
I'm still seeing this on the fuzzer, let's see if it still repros.
Created attachment 626270 [details] [diff] [review] fix This seemed to sketchy to just be fixed, at first I thought it was bug 756235 but reproduces with that applied too. Turns out it's similar though. LDefVar wasn't marked as a call, so LSRA gave it safepoint regs, which of course weren't spilled. To make it a call we also have to make it use the call temporary regs.