Fix data-flow analysis for BC_ITERL.
Fix iOS build.
Use thread-safe exceptions for external unwinding on x64/GCC.
Fix forced unwinding triggered by external unwinder.

--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -192,7 +192,7 @@ static BCReg snap_usedef(jit_State *J, uint8_t *udf,
     handle_jump: {
       BCReg minslot = bc_a(ins);
       if (op >= BC_FORI && op <= BC_JFORL) minslot += FORL_EXT;
-      else if (op >= BC_ITERL && op <= BC_JITERL) minslot += bc_b(pc[-1])-1;
+      else if (op >= BC_ITERL && op <= BC_JITERL) minslot += bc_b(pc[-2])-1;
       else if (op == BC_UCLO) { pc += bc_j(ins); break; }
       for (s = minslot; s < maxslot; s++) DEF_SLOT(s);
       return minslot < maxslot ? minslot : maxslot;
--- a/src/buildvm_asm.c
+++ b/src/buildvm_asm.c
@@ -191,7 +191,8 @@ void emit_asm(BuildCtx *ctx)
   if (ctx->mode != BUILD_machasm)
     fprintf(ctx->fp, ".Lbegin:\n");
 
-#if LJ_TARGET_ARM && defined(__GNUC__) && !defined(__symbian__)
+#if LJ_TARGET_ARM && defined(__GNUC__) && !defined(__symbian__) && \
+    !LJ_TARGET_OSX
   /* This should really be moved into buildvm_arm.dasc. */
   fprintf(ctx->fp,
 	  ".fnstart\n"
@@ -227,7 +228,8 @@ void emit_asm(BuildCtx *ctx)
 #endif
   }
 
-#if LJ_TARGET_ARM && defined(__GNUC__) && !defined(__symbian__)
+#if LJ_TARGET_ARM && defined(__GNUC__) && !defined(__symbian__) && \
+    !LJ_TARGET_OSX
   fprintf(ctx->fp,
 	  ".globl lj_err_unwind_arm\n"
 	  ".personality lj_err_unwind_arm\n"
--- a/src/lj_asm.c
+++ b/src/lj_asm.c
@@ -859,19 +859,23 @@ static uint32_t ir_khash(IRIns *ir)
   return hashrot(lo, hi);
 }
 
+#if !LJ_TARGET_X86ORX64 && LJ_TARGET_OSX
+void sys_icache_invalidate(void *start, size_t len);
+#endif
+
 /* Flush instruction cache. */
 static void asm_cache_flush(MCode *start, MCode *end)
 {
   VG_INVALIDATE(start, (char *)end-(char *)start);
 #if LJ_TARGET_X86ORX64
   UNUSED(start); UNUSED(end);
-#else
-#if defined(__GNUC__)
+#elif LJ_TARGET_OSX
+  sys_icache_invalidate(start, end-start);
+#elif defined(__GNUC__)
   __clear_cache(start, end);
 #else
 #error "Missing builtin to flush instruction cache"
 #endif
-#endif
 }
 
 /* -- Allocations --------------------------------------------------------- */
--- a/src/lj_ircall.h
+++ b/src/lj_ircall.h
@@ -182,8 +182,6 @@ LJ_DATA const CCallInfo lj_ir_callinfo[IRCALL__MAX+1];
 #define softfp_f2d __aeabi_f2d
 #define softfp_d2i __aeabi_d2iz
 #define softfp_d2ui __aeabi_d2uiz
-#define softfp_d2l __aeabi_d2lz
-#define softfp_d2ul __aeabi_d2ulz
 #define softfp_d2f __aeabi_d2f
 #define softfp_i2f __aeabi_i2f
 #define softfp_ui2f __aeabi_ui2f
@@ -191,8 +189,17 @@ LJ_DATA const CCallInfo lj_ir_callinfo[IRCALL__MAX+1];
 #define softfp_ul2f __aeabi_ul2f
 #define softfp_f2i __aeabi_f2iz
 #define softfp_f2ui __aeabi_f2uiz
+#if LJ_TARGET_OSX
+#define softfp_d2l __fixdfdi
+#define softfp_d2ul __fixunsdfdi
+#define softfp_f2l __fixsfdi
+#define softfp_f2ul __fixunssfdi
+#else
+#define softfp_d2l __aeabi_d2lz
+#define softfp_d2ul __aeabi_d2ulz
 #define softfp_f2l __aeabi_f2lz
 #define softfp_f2ul __aeabi_f2ulz
+#endif
 #else
 #error "Missing soft-float definitions for target architecture"
 #endif
--- a/src/lj_err.c
+++ b/src/lj_err.c
@@ -178,7 +178,8 @@ static void *err_unwind(lua_State *L, void *stopcf, int errcode)
 
 /* -- External frame unwinding -------------------------------------------- */
 
-#if defined(__GNUC__) && !defined(__symbian__)
+#if defined(__GNUC__) && !defined(__symbian__) && \
+    !(LJ_TARGET_ARM && LJ_TARGET_OSX)
 
 #ifdef __clang__
 /* http://llvm.org/bugs/show_bug.cgi?id=8703 */
@@ -227,7 +228,9 @@ LJ_FUNCA int lj_err_unwind_dwarf(int version, _Unwind_Action actions,
     }
 #if LJ_UNWIND_EXT
     cf = err_unwind(L, cf, errcode);
-    if (cf) {
+    if ((actions & _UA_FORCE_UNWIND)) {
+      return _URC_CONTINUE_UNWIND;
+    } else if (cf) {
       _Unwind_SetGR(ctx, LJ_TARGET_EHRETREG, errcode);
       _Unwind_SetIP(ctx, (_Unwind_Ptr)(cframe_unwind_ff(cf) ?
 				       lj_vm_unwind_ff_eh :
@@ -255,8 +258,12 @@ LJ_FUNCA int lj_err_unwind_dwarf(int version, _Unwind_Action actions,
 }
 
 #if LJ_UNWIND_EXT
-/* NYI: this is not thread-safe. */
+#if LJ_TARGET_OSX
+/* Sorry, no thread safety for OSX. Complain to Apple, not me. */
 static struct _Unwind_Exception static_uex;
+#else
+static __thread struct _Unwind_Exception static_uex;
+#endif
 
 /* Raise DWARF2 exception. */
 static void err_raise_ext(int errcode)
@@ -280,7 +287,7 @@ LJ_FUNCA _Unwind_Reason_Code lj_err_unwind_arm(_Unwind_State state,
     setstrV(L, L->top++, lj_err_str(L, LJ_ERR_ERRCPP));
     return _URC_HANDLER_FOUND;
   }
-  if ((state & _US_ACTION_MASK) == _US_UNWIND_FRAME_STARTING) {
+  if ((state&(_US_ACTION_MASK|_US_FORCE_UNWIND)) == _US_UNWIND_FRAME_STARTING) {
     _Unwind_DeleteException(ucb);
     _Unwind_SetGR(ctx, 15, (_Unwind_Word)(void *)lj_err_throw);
     _Unwind_SetGR(ctx, 0, (_Unwind_Word)L);