@@ -0,0 +1,35 @@
+import Builder from '../Builder.js'
+import * as assert from '../assert.js'
+
+const argumentCount = 8;
+const counter = argumentCount;
+
+let f = new Builder()
+    .Type().End()
+    .Function().End()
+    .Export().Function("readArgumentsLate").End()
+    .Code()
+    .Function("readArgumentsLate", { params: new Array(argumentCount).fill("i32"), ret: "i32" }, ["i32"])
+        .I32Const(0)
+        .SetLocal(counter)
+        .Loop("void")
+        .Block("void", b => b
+            .GetLocal(counter).I32Const(64).I32Eq().BrIf(0)
+            .GetLocal(counter).I32Const(1).I32Add().SetLocal(counter)
+            .Br(1))
+        .End();
+
+f = f.GetLocal(0);
+for (let i = 1; i < argumentCount; ++i)
+    f = f.GetLocal(i).I32Const(i + 1).I32Mul().I32Add();
+
+const bin = f.Return().End().End().WebAssembly().get();
+const instance = new WebAssembly.Instance(new WebAssembly.Module(bin));
+
+const args = [11, 22, 33, 44, 55, 66, 77, 88];
+let expected = args[0];
+for (let i = 1; i < argumentCount; ++i)
+    expected += args[i] * (i + 1);
+
+for (let i = 0; i < wasmTestLoopCount; ++i)
+    assert.eq(expected, instance.exports.readArgumentsLate(...args));
@@ -0,0 +1,73 @@
+//@ requireOptions("--useWasmTailCalls=true")
+import { instantiate } from "../wabt-wrapper.js"
+import * as assert from "../assert.js"
+
+// A cross-instance return_call_indirect whose arguments are locals held in registers. Every
+// allocatable GPR holds a local, so making the restore frame needs a scratch that evicts one of
+// them. Locals are set in register allocation order (ARM64: x0-x7, x9-x15). The high-index locals
+// land in the registers freed before the frame is copied, so only high-index slots bound the copy;
+// local 0 lands in the first register the scratch can take, and its slot is far above that bound.
+const argumentCount = 15;
+const setOrder = [14, 13, 11, 10, 9, 8, 7, 6, 12, 0, 1, 2, 3, 4, 5];
+const params = Array(argumentCount).fill("i32").join(" ");
+
+function weightedSum(values)
+{
+    let sum = 0;
+    for (let i = 0; i < values.length; ++i)
+        sum = (sum + Math.imul(values[i], i + 1)) | 0;
+    return sum;
+}
+
+const calleeBody = [];
+for (let i = 0; i < argumentCount; ++i)
+    calleeBody.push(`(local.get ${i}) (i32.const ${i + 1}) (i32.mul)`, i ? "(i32.add)" : "");
+
+const watCallee = `
+(module
+    (type $sig (func (param ${params}) (result i32)))
+    (func (export "weightedSum") (type $sig)
+        ${calleeBody.join("\n        ")}
+    )
+)`;
+
+const locals = [];
+const sets = [];
+const gets = [];
+for (let i = 0; i < argumentCount; ++i) {
+    locals.push(`(local $l${i} i32)`);
+    gets.push(`(local.get $l${i})`);
+}
+for (let i of setOrder)
+    sets.push(`(local.set $l${i} (i32.add (global.get $base) (i32.const ${(i + 1) * 7})))`);
+
+const watCaller = `
+(module
+    (type $sig (func (param ${params}) (result i32)))
+    (import "m" "weightedSum" (func $weightedSum (type $sig)))
+    (import "m" "base" (global $base i32))
+    (table 1 funcref)
+    (elem (i32.const 0) $weightedSum)
+    (func (export "test") (result i32)
+        ${locals.join(" ")}
+        ${sets.join("\n        ")}
+        ${gets.join(" ")}
+        (i32.const 0)
+        (return_call_indirect (type $sig))
+    )
+)`;
+
+async function test()
+{
+    const base = 1000;
+    const callee = await instantiate(watCallee, { }, { tail_call: true });
+    const caller = await instantiate(watCaller, {
+        m: { weightedSum: callee.exports.weightedSum, base: new WebAssembly.Global({ value: "i32" }, base) },
+    }, { tail_call: true });
+
+    const expected = weightedSum(Array.from({ length: argumentCount }, (_, i) => base + (i + 1) * 7));
+    for (let i = 0; i < wasmTestLoopCount; ++i)
+        assert.eq(caller.exports.test(), expected);
+}
+
+await assert.asyncTest(test());
@@ -0,0 +1,121 @@
+import * as assert from '../assert.js'
+import { instantiate } from '../wabt-wrapper.js';
+
+async function test() {
+    // The same local reaching a call twice, so the parallel move has to fan one source out to two
+    // parameter registers.
+    {
+        const instance = await instantiate(`
+        (func $sub (param i32) (param i32) (result i32)
+            (i32.sub (local.get 0) (local.get 1)))
+
+        (func (export "foo") (param i32) (result i32)
+            (call $sub (local.get 0) (local.get 0)))
+        `);
+        assert.eq(instance.exports.foo(7), 0);
+    }
+
+    // Fan-out and a swap in the same move: the third argument shares a source with the first, while
+    // the first two are passed in the opposite order to the one they arrive in.
+    {
+        const instance = await instantiate(`
+        (func $mix (param i32) (param i32) (param i32) (result i32)
+            (i32.add (i32.mul (local.get 0) (i32.const 100))
+                     (i32.add (i32.mul (local.get 1) (i32.const 10)) (local.get 2))))
+
+        (func (export "foo") (param i32) (param i32) (result i32)
+            (call $mix (local.get 1) (local.get 0) (local.get 1)))
+        `);
+        assert.eq(instance.exports.foo(2, 3), 323);
+    }
+
+    // One local filling every parameter, to exercise a source that is already-moved by the time the
+    // later copies are emitted.
+    {
+        const instance = await instantiate(`
+        (func $sum4 (param i32) (param i32) (param i32) (param i32) (result i32)
+            (i32.add (i32.add (local.get 0) (local.get 1))
+                     (i32.add (local.get 2) (local.get 3))))
+
+        (func (export "foo") (param i32) (result i32)
+            (call $sum4 (local.get 0) (local.get 0) (local.get 0) (local.get 0)))
+        `);
+        assert.eq(instance.exports.foo(5), 20);
+    }
+
+    // The same local as two return values.
+    {
+        const instance = await instantiate(`
+        (func (export "foo") (param i32) (result i32 i32)
+            (local.get 0) (local.get 0))
+        `);
+        assert.eq(instance.exports.foo(11), [11, 11]);
+    }
+
+    // Floats, so the fan-out runs through the FPR side of the move.
+    {
+        const instance = await instantiate(`
+        (func $fsub (param f64) (param f64) (result f64)
+            (f64.sub (local.get 0) (local.get 1)))
+
+        (func (export "foo") (param f64) (result f64 f64)
+            (call $fsub (local.get 0) (local.get 0))
+            (local.get 0))
+        `);
+        assert.eq(instance.exports.foo(1.5), [0, 1.5]);
+    }
+
+    // Several entries naming one local when a write to it lands: each needs the old value, and the
+    // reads afterwards need the new one.
+    {
+        const instance = await instantiate(`
+        (func (export "foo") (param i32) (result i32 i32 i32 i32)
+            (local.get 0)
+            (local.get 0)
+            (local.get 0)
+            (local.set 0 (i32.const 42))
+            (local.get 0))
+        `);
+        assert.eq(instance.exports.foo(3), [3, 3, 3, 42]);
+    }
+
+    // A write inside a nested block, with the readers sitting on the enclosing stack.
+    {
+        const instance = await instantiate(`
+        (func (export "foo") (param i32) (result i32 i32 i32)
+            (local.get 0)
+            (local.get 0)
+            (block (local.set 0 (i32.const 0xbbadbeef)))
+            (local.get 0))
+        `);
+        assert.eq(instance.exports.foo(3), [3, 3, 0xbbadbeef | 0]);
+    }
+
+    // Duplicate namers crossing a block boundary as that block's results.
+    {
+        const instance = await instantiate(`
+        (func (export "foo") (param i32) (result i32 i32)
+            (block (result i32 i32)
+                (local.get 0)
+                (local.get 0)))
+        `);
+        assert.eq(instance.exports.foo(9), [9, 9]);
+    }
+
+    // Duplicate namers live across a loop back edge.
+    {
+        const instance = await instantiate(`
+        (func (export "foo") (param i32) (result i32)
+            (local i32)
+            (local.set 1 (i32.const 0))
+            (loop $l
+                (local.set 1 (i32.add (local.get 1) (i32.add (local.get 0) (local.get 0))))
+                (local.set 0 (i32.sub (local.get 0) (i32.const 1)))
+                (br_if $l (local.get 0)))
+            (local.get 1))
+        `);
+        assert.eq(instance.exports.foo(4), 20);
+    }
+}
+
+await assert.asyncTest(test());
@@ -120,15 +120,6 @@ const RegisterAtOffsetList& RegisterAtOffsetList::ipintCalleeSaveRegisters()
     return result.get();
 }
 
-const RegisterAtOffsetList& RegisterAtOffsetList::bbqCalleeSaveRegisters()
-{
-    static std::once_flag onceKey;
-    static LazyNeverDestroyed<RegisterAtOffsetList> result;
-    std::call_once(onceKey, [] {
-        result.construct(RegisterSet::bbqCalleeSaveRegisters());
-    });
-    return result.get();
-}
 #endif
 
 } // namespace JSC
 
@@ -73,7 +73,6 @@ class RegisterAtOffsetList {
 #if ENABLE(WEBASSEMBLY)
     static const RegisterAtOffsetList& wasmPinnedRegisters();
     static const RegisterAtOffsetList& ipintCalleeSaveRegisters(); // Registers and Offsets saved and used by IPInt.
-    static const RegisterAtOffsetList& bbqCalleeSaveRegisters(); // Registers and Offsets saved and used by BBQ.
 #endif
 
 private: