The 64-bit llint keeps the PC as an offset into the bytecode instead of an address. When calling out to C++ slow paths, the llint converts the PC to an address before the call, and converts it back to an offset after returning from the call. Given that the PC may be pointing to a glue trampoline outside of the current bytecode, the resultant offset can be negative. The shift operation there is used to divide the offset by 8 so that it becomes a bytecode Opcode offset instead of a byte offset. If the original byte offset is negative, we need to do this shift with a regular rshift instead of the unsigned urshift. The urshift will convert the negative offset into an erroneously large positive offset. Using an rshift will do the right thing and divide the offset by 8.
Created attachment 171731 [details] Fix.
Landed in r133089: <http://trac.webkit.org/changeset/133089>.