Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py	(revision 101848)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py	(revision 101849)
@@ -70,5 +70,5 @@
 
     'IEM_MC_CALL_CIMPL_1_THREADED':                              (None, True,  True,  ),
-    'IEM_MC_CALL_CIMPL_2_THREADED':                              (None, True,  False, ),
+    'IEM_MC_CALL_CIMPL_2_THREADED':                              (None, True,  True,  ),
     'IEM_MC_CALL_CIMPL_3_THREADED':                              (None, True,  False, ),
     'IEM_MC_CALL_CIMPL_4_THREADED':                              (None, True,  False, ),
Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 101848)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 101849)
@@ -2385,5 +2385,5 @@
             while (fGstRegShadows)
             {
-                unsigned const idxGstReg = ASMBitFirstSetU64(fGstRegShadows);
+                unsigned const idxGstReg = ASMBitFirstSetU64(fGstRegShadows) - 1;
                 fGstRegShadows &= ~RT_BIT_64(idxGstReg);
 
@@ -4867,5 +4867,5 @@
     uint8_t const a_Name = iemNativeArgAlloc(pReNative, (a_iArg), sizeof(a_Type))
 
-#define IEM_MC_ARG_CONST(a_Type, a_Name, a_iArg) \
+#define IEM_MC_ARG_CONST(a_Type, a_Name, a_Value, a_iArg) \
     uint8_t const a_Name = iemNativeArgAllocConst(pReNative, (a_iArg), sizeof(a_Type), (a_Value))
 
@@ -4903,5 +4903,5 @@
 {
     Assert(cbType > 0 && cbType <= 64);
-    unsigned const idxVar = ASMBitFirstSetU32(~pReNative->Core.bmVars);
+    unsigned const idxVar = ASMBitFirstSetU32(~pReNative->Core.bmVars) - 1;
     AssertStmt(idxVar < RT_ELEMENTS(pReNative->Core.aVars), IEMNATIVE_DO_LONGJMP(pReNative, VERR_IEM_VAR_EXHAUSTED));
     pReNative->Core.bmVars |= RT_BIT_32(idxVar);
@@ -4960,5 +4960,5 @@
             if (pReNative->Core.aVars[idxVar].cbVar <= sizeof(uint64_t))
             {
-                unsigned const iSlot = ASMBitFirstSetU32(~pReNative->Core.bmStack);
+                unsigned const iSlot = ASMBitFirstSetU32(~pReNative->Core.bmStack) - 1;
                 AssertStmt(iSlot < IEMNATIVE_FRAME_VAR_SLOTS, IEMNATIVE_DO_LONGJMP(pReNative, VERR_IEM_VAR_OUT_OF_STACK_SLOTS));
                 pReNative->Core.bmStack |= RT_BIT_32(iSlot);
@@ -5333,8 +5333,11 @@
             {
                 uint8_t const idxVar = pReNative->Core.aidxArgVars[i];
-                if (pReNative->Core.aVars[idxVar].uArgNo < RT_ELEMENTS(pReNative->Core.aHstRegs))
+                if (pReNative->Core.aVars[idxVar].idxReg < RT_ELEMENTS(pReNative->Core.aHstRegs))
                 {
                     Assert(pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Stack);
                     off = iemNativeEmitLoadGprFromGpr(pReNative, off, idxArgReg, pReNative->Core.aVars[idxVar].idxReg);
+                    pReNative->Core.bmHstRegs = (pReNative->Core.bmHstRegs & ~RT_BIT_32(pReNative->Core.aVars[idxVar].idxReg))
+                                              | RT_BIT_32(idxArgReg);
+                    pReNative->Core.aVars[idxVar].idxReg = idxArgReg;
                 }
                 else
@@ -5402,8 +5405,10 @@
             uint8_t const idxVar    = pReNative->Core.aidxArgVars[i];
             int32_t const offBpDisp = g_aoffIemNativeCallStackArgBpDisp[i - IEMNATIVE_CALL_ARG_GREG_COUNT];
-            if (pReNative->Core.aVars[idxVar].uArgNo < RT_ELEMENTS(pReNative->Core.aHstRegs))
+            if (pReNative->Core.aVars[idxVar].idxReg < RT_ELEMENTS(pReNative->Core.aHstRegs))
             {
                 Assert(pReNative->Core.aVars[idxVar].enmKind == kIemNativeVarKind_Stack); /* Imm as well? */
-                off = iemNativeEmitStoreGprByBp(pReNative, off, offBpDisp, pReNative->Core.aVars[idxVar].uArgNo);
+                off = iemNativeEmitStoreGprByBp(pReNative, off, offBpDisp, pReNative->Core.aVars[idxVar].idxReg);
+                pReNative->Core.bmHstRegs &= ~RT_BIT_32(pReNative->Core.aVars[idxVar].idxReg);
+                pReNative->Core.aVars[idxVar].idxReg = UINT8_MAX;
             }
             else
@@ -5471,6 +5476,4 @@
         pReNative->Core.aidxArgVars[i] = UINT8_MAX;
         pReNative->Core.bmVars        &= ~RT_BIT_32(idxVar);
-        Assert(   pReNative->Core.aVars[idxVar].idxReg
-               == (i < RT_ELEMENTS(g_aidxIemNativeCallRegs) ? g_aidxIemNativeCallRegs[i] : UINT8_MAX));
     }
     Assert(pReNative->Core.u64ArgVars == UINT64_MAX);
@@ -5491,5 +5494,4 @@
 
 {
-//pReNative->pInstrBuf[off++] = 0xcc;
     /*
      * Do all the call setup and cleanup.
@@ -5564,4 +5566,5 @@
                         uintptr_t pfnCImpl, uint8_t idxArg0, uint8_t idxArg1, uint8_t idxArg2)
 {
+pReNative->pInstrBuf[off++] = 0xcc;
     Assert(idxArg0 < RT_ELEMENTS(pReNative->Core.aVars) && (pReNative->Core.bmVars & RT_BIT_32(idxArg0)));
     Assert(pReNative->Core.aVars[idxArg0].uArgNo == 0 + IEM_CIMPL_HIDDEN_ARGS);
@@ -5588,4 +5591,5 @@
                         uintptr_t pfnCImpl, uint8_t idxArg0, uint8_t idxArg1, uint8_t idxArg2, uint8_t idxArg3)
 {
+pReNative->pInstrBuf[off++] = 0xcc;
     Assert(idxArg0 < RT_ELEMENTS(pReNative->Core.aVars) && (pReNative->Core.bmVars & RT_BIT_32(idxArg0)));
     Assert(pReNative->Core.aVars[idxArg0].uArgNo == 0 + IEM_CIMPL_HIDDEN_ARGS);
@@ -5616,4 +5620,5 @@
                         uintptr_t pfnCImpl, uint8_t idxArg0, uint8_t idxArg1, uint8_t idxArg2, uint8_t idxArg3, uint8_t idxArg4)
 {
+pReNative->pInstrBuf[off++] = 0xcc;
     Assert(idxArg0 < RT_ELEMENTS(pReNative->Core.aVars) && (pReNative->Core.bmVars & RT_BIT_32(idxArg0)));
     Assert(pReNative->Core.aVars[idxArg0].uArgNo == 0 + IEM_CIMPL_HIDDEN_ARGS);
