S1 scratch register, which should hold the constant value, is reused during the process. Fix attached.
Created attachment 186850 [details] patch
If we ever need bigger offsets, we can do that with a sequence of add/sub instructions. It will not be effective, but at least it will work.
Created attachment 187090 [details] improved patch Patch without assert.
Oliver, could you review it?
Comment on attachment 187090 [details] improved patch Clearing flags on attachment: 187090 Committed r142146: <http://trac.webkit.org/changeset/142146>
All reviewed patches have been landed. Closing bug.