x64/LJ_GC64: Fix JIT glue code in interpreter.

Thanks to Peter Cawley.

src/vm_x64.dasc

@@ -2325,7 +2325,8 @@ static void build_subroutines(BuildCtx *ctx)
   |->cont_stitch:			// Trace stitching.
   |.if JIT
   |  // BASE = base, RC = result, RB = mbase
-  |  mov ITYPEd, [RB-24]		// Save previous trace number.
+  |  mov TRACE:ITYPE, [RB-40]		// Save previous trace.
+  |  cleartp TRACE:ITYPE
   |  mov TMPRd, MULTRES
   |  movzx RAd, PC_RA
   |  lea RA, [BASE+RA*8]		// Call base.
@@ -2347,11 +2348,10 @@ static void build_subroutines(BuildCtx *ctx)
   |  cmp RC, RA
   |  ja >9				// More results wanted?
   |
-  |  mov RA, [DISPATCH+DISPATCH_J(trace)]
-  |  mov TRACE:RD, [RA+ITYPE*8]
-  |  test TRACE:RD, TRACE:RD
+  |  test TRACE:ITYPE, TRACE:ITYPE
   |  jz ->cont_nop
-  |  movzx RDd, word TRACE:RD->link
+  |  movzx RBd, word TRACE:ITYPE->traceno
+  |  movzx RDd, word TRACE:ITYPE->link
   |  cmp RDd, RBd
   |  je ->cont_nop			// Blacklisted.
   |  test RDd, RDd
@@ -2404,10 +2404,10 @@ static void build_subroutines(BuildCtx *ctx)
   |  mov [rbp-8], r15; mov [rbp-16], r14
   |  // Caveat: DISPATCH is rbx.
   |  mov DISPATCH, [ebp]
-  |  mov RA, [DISPATCH+DISPATCH_GL(vmstate)]	// Get trace number.
+  |  mov RAd, [DISPATCH+DISPATCH_GL(vmstate)]	// Get trace number.
   |  set_vmstate EXIT
-  |  mov [DISPATCH+DISPATCH_J(exitno)], RC
-  |  mov [DISPATCH+DISPATCH_J(parent)], RA
+  |  mov [DISPATCH+DISPATCH_J(exitno)], RCd
+  |  mov [DISPATCH+DISPATCH_J(parent)], RAd
   |.if X64WIN
   |  sub rsp, 16*8+4*8			// Room for SSE regs + save area.
   |.else
@@ -2433,7 +2433,7 @@ static void build_subroutines(BuildCtx *ctx)
   |  mov CARG2, rsp
   |.endif
   |  lea CARG1, [DISPATCH+GG_DISP2J]
-  |  mov dword [DISPATCH+DISPATCH_GL(jit_base)], 0
+  |  mov qword [DISPATCH+DISPATCH_GL(jit_base)], 0
   |  call extern lj_trace_exit		// (jit_State *J, ExitState *ex)
   |  // MULTRES or negated error code returned in eax (RD).
   |  mov RA, L:RB->cframe
@@ -2480,7 +2480,7 @@ static void build_subroutines(BuildCtx *ctx)
   |  mov KBASE, LFUNC:KBASE->pc
   |  mov KBASE, [KBASE+PC2PROTO(k)]
   |  mov L:RB->base, BASE
-  |  mov dword [DISPATCH+DISPATCH_GL(jit_base)], 0
+  |  mov qword [DISPATCH+DISPATCH_GL(jit_base)], 0
   |  set_vmstate INTERP
   |  // Modified copy of ins_next which handles function header dispatch, too.
   |  mov RCd, [PC]
@@ -2504,7 +2504,7 @@ static void build_subroutines(BuildCtx *ctx)
   |  // Otherwise set KBASE for Lua function below fast function.
   |  movzx RCd, byte [RC-3]
   |  neg RC
-  |  mov LFUNC:KBASE, [BASE+RC*8-24]
+  |  mov LFUNC:KBASE, [BASE+RC*8-32]
   |  cleartp LFUNC:KBASE
   |  mov KBASE, LFUNC:KBASE->pc
   |  mov KBASE, [KBASE+PC2PROTO(k)]
@@ -4050,7 +4050,7 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  mov RC, [RA-24]			// Copy control var. fb[1] = fb[-3].
     |  mov [RA], RB
     |  mov [RA+8], RC
-    |  mov LFUNC:RB, [RA-40]		// Copy callable. fb[-1] = fb[-5]
+    |  mov LFUNC:RB, [RA-40]		// Copy callable. fb[-2] = fb[-5]
     |  mov [RA-16], LFUNC:RB
     |  mov NARGS:RDd, 2+1		// Handle like a regular 2-arg call.
     |  checkfunc LFUNC:RB, ->vmeta_call