MoarVM Oops when running t/04-nativecall/15-rw-args.t with a small nursery and MVM_SPESH_NODELAY=1

[dogbert17]

Here's my setup in order to reproduce the issue

Changes in MoarVM

dogbert@dogbert-VirtualBox:~/repos/rakudo/nqp/MoarVM$ git diff
diff --git a/src/gc/collect.h b/src/gc/collect.h
index 153805096..25922ff1f 100644
--- a/src/gc/collect.h
+++ b/src/gc/collect.h
@@ -1,6 +1,6 @@
 /* The maximum size of the nursery area. Note that since it's semi-space
  * copying, we could actually have double this amount allocated per thread. */
-#define MVM_NURSERY_SIZE 4194304
+#define MVM_NURSERY_SIZE 4200
 
 /* The nursery size threads other than the main thread start out with. If
  * they fill it and trigger a GC run, then it is doubled. If they are
diff --git a/src/spesh/usages.h b/src/spesh/usages.h
index 499a55d1f..af94d21ff 100644
--- a/src/spesh/usages.h
+++ b/src/spesh/usages.h
@@ -1,5 +1,5 @@
 /* Option to enable checking of define/use chains for debugging purposes. */
-#define MVM_SPESH_CHECK_DU 0
+#define MVM_SPESH_CHECK_DU 1
 
 /* Usage information, which is held per SSA written register. */
 struct MVMSpeshUsages {

Rakudo version

dogbert@dogbert-VirtualBox:~/repos/rakudo$ ./rakudo-m -v
Welcome to Rakudo™ v2022.04-75-g19c3bd180.
Implementing the Raku® Programming Language v6.d.
Built on MoarVM version 2022.04-3-ga9fcd5a74.

What happens

dogbert@dogbert-VirtualBox:~/repos/rakudo$ MVM_SPESH_NODELAY=1 ./rakudo-m -Ilib t/04-nativecall/15-rw-args.t
1..24
ok 1 - Perl's rw variable was set by C (char)
ok 2 - Perl's rw variable was passed and returned by C (char)
ok 3 - Perl's rw variable was set by C (short)
ok 4 - Perl's rw variable was passed and returned by C (short)
ok 5 - Perl's rw variable was set by C (long)
ok 6 - Perl's rw variable was passed and returned by C (long)
ok 7 - Perl's rw variable was set by C (long long)
ok 8 - Perl's rw variable was passed and returned by C (longlong)
ok 9 - Perl's rw variable was set by C (float)
ok 10 - Perl's rw variable was passed and returned by C (float)
ok 11 - Perl's rw variable was set by C (double)
ok 12 - Perl's rw variable was passed and returned by C (double)
ok 13 - Perl's rw variable was set by C (unsigned char)
ok 14 - Perl's rw variable was passed and returned by C (unsigned char)
ok 15 - Perl's rw variable was set by C (unsigned short)
ok 16 - Perl's rw variable was passed and returned by C (unsigned short)
ok 17 - Perl's rw variable was set by C (unsigned long)
ok 18 - Perl's rw variable was passed and returned by C (unsigned long)
ok 19 - Perl's rw variable was set by C (unsigned long long)
ok 20 - Perl's rw variable was passed and returned by C (unsigned long long)
ok 21 - Perl's rw variable was set by C (size_t)
ok 22 - Perl's rw variable was passed and returned by C (size_t)
ok 23 - Can pass an instantiated pointer with rw-trait to C
ok 24 - Perl's rw variable was set by C (pointer)
MoarVM oops in spesh thread: Malformed DU chain: writer getlexref_i8 of 40(11) in BB 41 is incorrect
Spesh of '<unit>' (cuid: 76, file: t/04-nativecall/15-rw-args.t:1)
Callsite 0x7f8159507c50 (0 args, 0 pos)

  BB 0 (0x33f6cc75440):
    line: 1 (pc 0)
    Instructions:
      no_op           
    Successors: 1
    Predecessors: 
    Dominance children: 1

  BB 1 (0x33f6cc754c8):
    line: 1 (pc 0)
    Instructions:
      getcode          r41(2), coderef(t/04-nativecall/15-rw-args.t:12 (closure))
      capturelex       r41(2)
      getcode          r41(3), coderef(t/04-nativecall/15-rw-args.t:13 (closure))
      capturelex       r41(3)
      getcode          r41(4), coderef(t/04-nativecall/15-rw-args.t:14 (closure))
      capturelex       r41(4)
      getcode          r41(5), coderef(t/04-nativecall/15-rw-args.t:15 (closure))
      capturelex       r41(5)
      getcode          r41(6), coderef(t/04-nativecall/15-rw-args.t:16 (closure))
      capturelex       r41(6)
      getcode          r41(7), coderef(t/04-nativecall/15-rw-args.t:17 (closure))
      capturelex       r41(7)
      getcode          r41(8), coderef(t/04-nativecall/15-rw-args.t:18 (closure))
      capturelex       r41(8)
      getcode          r41(9), coderef(t/04-nativecall/15-rw-args.t:19 (closure))
      capturelex       r41(9)
      getcode         r41(10), coderef(t/04-nativecall/15-rw-args.t:20 (closure))
      capturelex      r41(10)
      getcode         r41(11), coderef(t/04-nativecall/15-rw-args.t:21 (closure))
      capturelex      r41(11)
      getcode         r41(12), coderef(t/04-nativecall/15-rw-args.t:22 (closure))
      capturelex      r41(12)
      getcode         r41(13), coderef(t/04-nativecall/15-rw-args.t:23 (closure))
      capturelex      r41(13)
      getcode         r41(14), coderef(t/04-nativecall/15-rw-args.t:24 (closure))
      capturelex      r41(14)
      getcode         r41(15), coderef(t/04-nativecall/15-rw-args.t:25 (closure))
      capturelex      r41(15)
      getcode         r41(16), coderef(t/04-nativecall/15-rw-args.t:26 (closure))
      capturelex      r41(16)
      getcode         r41(17), coderef(t/04-nativecall/15-rw-args.t:27 (closure))
      capturelex      r41(17)
      getcode         r41(18), coderef(t/04-nativecall/15-rw-args.t:28 (closure))
      capturelex      r41(18)
      getcode         r41(19), coderef(t/04-nativecall/15-rw-args.t:29 (closure))
      capturelex      r41(19)
      getcode         r41(20), coderef(t/04-nativecall/15-rw-args.t:30 (closure))
      capturelex      r41(20)
      getcode         r41(21), coderef(t/04-nativecall/15-rw-args.t:31 (closure))
      capturelex      r41(21)
      getcode         r41(22), coderef(t/04-nativecall/15-rw-args.t:32 (closure))
      capturelex      r41(22)
      getcode         r41(23), coderef(t/04-nativecall/15-rw-args.t:34 (closure))
      capturelex      r41(23)
      getcode         r41(24), coderef(t/04-nativecall/15-rw-args.t:35 (closure))
      capturelex      r41(24)
      getcode           r1(2), coderef(t/04-nativecall/15-rw-args.t:3)
      takeclosure       r1(3),   r1(2)
      [Annotation: Logged (bytecode offset 250)]
      [Annotation: Line Number: t/04-nativecall/15-rw-args.t:1]
      sp_getlex_o       r2(4), lex(idx=35,outers=0,&trait_mod:<is>)
      [Annotation: INS Deopt One After Instruction (idx 0 -> pc 258; line 1)]
      sp_guardconc      r2(2),   r2(4), sslot(0), litui32(0)
      [Annotation: Logged (bytecode offset 258)]
      set               r3(5),   r2(2)
    Successors: 2
    Predecessors: 0
    Dominance children: 2

  BB 2 (0x33f6cc75528):
    line: 1 (pc 264)
    Instructions:
      [Annotation: INS Deopt One After Instruction (idx 1 -> pc 264; line 1)]
      set               r3(2),   r3(5)
      const_s           r4(1), lits(clone)
      sp_getspeshslot  r48(0), sslot(4)
      sp_resumption    r49(0), litui16(0), litui16(3),   r3(2),   r4(1),   r2(2)
      [Annotation: INS Deopt One Before Instruction (idx 2 -> pc 272; line 1)]
      [Annotation: INS Deopt All (idx 4 -> pc 288; line 1)]
      [Annotation: Cached (bytecode offset 272)]
      goto              BB(3)
    Successors: 3
    Predecessors: 1
    Dominance children: 4
    ...