fix reg-alloc `call` with variable destination bug