Fix safepoint stack slot reuse

cranelift/frontend/src/frontend/safepoints.rs

@@ -759,22 +759,25 @@ impl SafepointSpiller {
 
             let mut option_inst = func.layout.last_inst(block);
             while let Some(inst) = option_inst {
+                // If this instruction is a safepoint, then we must add stack
+                // map entries for the needs-stack-map values that are live
+                // across it.
+                if self.liveness.safepoints.contains_key(&inst) {
+                    self.rewrite_safepoint(func, inst);
+                }
+
                 // If this instruction defines a needs-stack-map value that is
                 // live across a safepoint, then spill the value to its stack
-                // slot.
+                // slot. Do this after rewriting the safepoint itself so that
+                // the stack map reserves slots for values live across this
+                // instruction before any slots for instruction results are
+                // freed for reuse.
                 let mut pos = FuncCursor::new(func).after_inst(inst);
                 vals.extend_from_slice(pos.func.dfg.inst_results(inst));
                 for val in vals.drain(..) {
                     self.rewrite_def(&mut pos, val);
                 }
 
-                // If this instruction is a safepoint, then we must add stack
-                // map entries for the needs-stack-map values that are live
-                // across it.
-                if self.liveness.safepoints.contains_key(&inst) {
-                    self.rewrite_safepoint(func, inst);
-                }
-
                 // Replace all uses of needs-stack-map values with loads from
                 // the value's associated stack slot.
                 let mut pos = FuncCursor::new(func).at_inst(inst);