Similar bug on mips like Bug #103146 on ARMv7. Running v8 test v7 with jsc such a case comes up where in replaceWithJump function a 4 bytes long direct jump instruction is not enough (to address is out of bounds),
Has been fixed with a non MIPS specific commit.
(In reply to comment #1) > Has been fixed with a non MIPS specific commit. Sorry, went to wrong bug fix.