Don't touch x18 on ARM64 - it is globally reserved on iOS.

runtime/vm/simulator_arm64.cc

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include <setjmp.h>  // NOLINT
 #include <stdlib.h>
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_ARM64)
 
@@ skipping 882 matching lines @@
   }
   return simulator;
 }
 
 
 // Sets the register in the architecture state.
 void Simulator::set_register(
     Instr* instr, Register reg, int64_t value, R31Type r31t) {
   // Register is in range.
   ASSERT((reg >= 0) && (reg < kNumberOfCpuRegisters));
+  ASSERT(instr == NULL || reg != R18);  // R18 is globally reserved on iOS.
   if ((reg != R31) || (r31t != R31IsZR)) {
     registers_[reg] = value;
     // If we're setting CSP, make sure it is 16-byte aligned. In truth, CSP
     // can store addresses that are not 16-byte aligned, but loads and stores
     // are not allowed through CSP when it is not aligned. Thus, this check is
     // more conservative that necessary. However, it will likely be more
     // useful to find the program locations where CSP is set to a bad value,
     // than to find only the resulting loads/stores that would cause a fault on
     // hardware.
     if ((instr != NULL) && (reg == R31) && !Utils::IsAligned(value, 16)) {
@@ skipping 730 matching lines @@
           reinterpret_cast<SimulatorNativeCall>(external);
       target(arguments, target_func);
       // Zap result register from void function.
       set_register(instr, R0, icount_);
       set_register(instr, R1, icount_);
     }
     set_top_exit_frame_info(0);
 
     // Zap caller-saved registers, since the actual runtime call could have
     // used them.
     set_register(instr, R2, icount_);

[rmacnak, 2015/10/19 20:11:04]

Maybe these should all be with NULL? They aren't the effect of any instruction.

[regis, 2015/10/19 20:42:55]

Yes.

[rmacnak, 2015/10/19 21:14:32]

Done.

     set_register(instr, R3, icount_);
     set_register(instr, R4, icount_);
     set_register(instr, R5, icount_);
     set_register(instr, R6, icount_);
     set_register(instr, R7, icount_);
     set_register(instr, R8, icount_);
     set_register(instr, R9, icount_);
     set_register(instr, R10, icount_);
     set_register(instr, R11, icount_);
     set_register(instr, R12, icount_);
     set_register(instr, R13, icount_);
     set_register(instr, R14, icount_);
     set_register(instr, R15, icount_);
     set_register(instr, IP0, icount_);
     set_register(instr, IP1, icount_);
-    set_register(instr, R18, icount_);
+    set_register(NULL, R18, icount_);
     set_register(instr, LR, icount_);
 
     // TODO(zra): Zap caller-saved fpu registers.
 
     // Return.
     set_pc(saved_lr);
   } else {
     // Coming via long jump from a throw. Continue to exception handler.
     set_top_exit_frame_info(0);
   }
@@ skipping 1856 matching lines @@
   set_register(NULL, kExceptionObjectReg, bit_cast<int64_t>(raw_exception));
   set_register(NULL, kStackTraceObjectReg, bit_cast<int64_t>(raw_stacktrace));
   buf->Longjmp();
 }
 
 }  // namespace dart
 
 #endif  // !defined(USING_SIMULATOR)
 
 #endif  // defined TARGET_ARCH_ARM64