gistfile1.txt

diff --git a/src/core/frame.c b/src/core/frame.c
index 383a145..ea305ee 100644
--- a/src/core/frame.c
+++ b/src/core/frame.c
@@ -572,9 +572,13 @@ static MVMuint64 remove_one_frame(MVMThreadContext *tc, MVMuint8 unwind) {
      * specialization. */
     if (returner->spesh_cand && returner->spesh_log_idx >= 0) {
         if (returner->spesh_cand->osr_logging) {
-            /* Didn't achieve enough log entries to complete the OSR; just
-             * drop it to normal logging. */
+            /* Didn't achieve enough log entries to complete the OSR, but
+             * clearly hot, so specialize anyway. This also avoids races
+             * when the candidate is called again later and still has
+             * sp_osrfinalize instructions in it. */
             returner->spesh_cand->osr_logging = 0;
+            MVM_spesh_candidate_specialize(tc, returner->static_info,
+                returner->spesh_cand);
         }
         else if (MVM_decr(&(returner->spesh_cand->log_exits_remaining)) == 1) {
             MVM_spesh_candidate_specialize(tc, returner->static_info,
diff --git a/src/core/interp.c b/src/core/interp.c
index 9a84b61..f13db29 100644
--- a/src/core/interp.c
+++ b/src/core/interp.c
@@ -4383,9 +4383,9 @@ void MVM_interp_run(MVMThreadContext *tc, void (*initial_invoke)(MVMThreadContex
             OP(sp_osrfinalize): {
                 MVMSpeshCandidate *cand = tc->cur_frame->spesh_cand;
                 if (cand) {
-                    cand->log_enter_idx++;
                     tc->cur_frame->spesh_log_idx = cand->log_enter_idx;
-                    if (--(cand->log_exits_remaining) == 0)
+                    cand->log_enter_idx++;
+                    if (cand->log_enter_idx >= MVM_SPESH_LOG_RUNS)
                         MVM_spesh_osr_finalize(tc);
                 }
                 goto NEXT;
diff --git a/src/spesh/osr.c b/src/spesh/osr.c
index 2b03a7d..b58f477 100644
--- a/src/spesh/osr.c
+++ b/src/spesh/osr.c
@@ -57,6 +57,7 @@ void MVM_spesh_osr(MVMThreadContext *tc) {
         tc->cur_frame->spesh_log_slots       = specialized->log_slots;
         tc->cur_frame->spesh_cand            = specialized;
         tc->cur_frame->spesh_log_idx         = 0;
+        specialized->log_enter_idx           = 1;
 
         /* Work out deopt index that applies, and move interpreter into the
          * logging version of the code. */