Segfault or crash on 2nd entry into routine

[SqrtNegInf]

The Problem

Unless MVM_SPESH_DISABLE=1 is set, the following code generates a segfault

use Image::PNG::Portable;
my $png = Image::PNG::Portable.new: :width(2000), :height(2000);
(say $_; $png.write: "test.png") for ^10;

The error always occurs on the 2nd call to String::CRC32::crc32, from Image::PNG::Portable, on the line:

$crc +^= 0xFFFFFFFF

Expected Behavior

This code should write/re-write a blank PNG to disk.

Actual Behavior

Either segfault or when debugging:

This type cannot unbox to a native integer: P6opaque, Mu

Steps to Reproduce

To avoid actual segfault and allow debugging, use MVM_JIT_DISABLE=1

This is Rakudo Perl 6 running in the GNU debugger, which often allows the user to generate useful back-traces to debug or report issues in Rakudo, the MoarVM backend or the currently running code.

This Rakudo version is 2018.10.29.g.052067.fd.1 built on MoarVM version 2018.10.26.g.318.e.1.ec.55,
running on macosx (10.11.6) / darwin (15.6.0)

------------------------------------------------------------------------------------------------
Reading symbols from /Users/dhoekman/.rakudobrew/moar-master/install/bin/moar...(no debugging symbols found)...done.
Starting program: /Users/dhoekman/.rakudobrew/moar-master/install/bin/moar --execname=/Users/dhoekman/.rakudobrew/bin/../moar-master/install/bin/perl6-gdb-m --libpath=/Users/dhoekman/.rakudobrew/moar-master/install/share/nqp/lib --libpath=/Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/lib --libpath=/Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/runtime /Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/runtime/perl6.moarvm exp/Bytes-write
[New Thread 0x1217 of process 38131]
0
1
This type cannot unbox to a native integer: P6opaque, Mu
  in sub crc32 at /Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/site/sources/B11DB940E55C33C6937C1A1A778565879AE880A0 (String::CRC32) line 51
  in sub write-chunk at /Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/site/sources/7941A7DCDF4B308B87530EF4CA5D4019405D3297 (Image::PNG::Portable) line 83
  in method write at /Users/dhoekman/.rakudobrew/moar-master/install/share/perl6/site/sources/7941A7DCDF4B308B87530EF4CA5D4019405D3297 (Image::PNG::Portable) line 64
  in block <unit> at exp/Bytes-write line 8

[Inferior 1 (process 38131) exited with code 01]

[dogbert17]

A manual bisect points to MoarVM/MoarVM@d806536

[niner]

Commenting out eliminate_unused_log_guards(tc, g); in MVM_spesh_optimize makes the error and segfault go away, so I guess we're just not marking a guard as used when we should.

[timo]

TYVM for reporting this crash, @SqrtNegInf, and thank you for the bisect, @dogbert17, and for paging me on IRC, @niner