It appears that on asm.js code, our constant motion is wrong: - It pins tags to registers even though the tags are not used frequently enough to warrant it. - It doesn't pin the heap base to a register even though it is used frequently enough to warrant it.
*** Bug 152107 has been marked as a duplicate of this bug. ***
Created attachment 269282 [details] the patch
Created attachment 269283 [details] the patch
Comment on attachment 269283 [details] the patch r=me
Landed in http://trac.webkit.org/changeset/195307