The FTL expects that this method can be used with scratch registers disallowed, but it uses addPtr(Addr, Reg). The solution is to not use addPtr(Addr, Reg).
Created attachment 286851 [details] the patch
Comment on attachment 286851 [details] the patch Clearing flags on attachment: 286851 Committed r204897: <http://trac.webkit.org/changeset/204897>
All reviewed patches have been landed. Closing bug.