lowerStackArgs checks that the FP offsets it tries to generate are valid form, but doesn't check that the fallback is valid form. This leads to stackAddr's assertion being dead, and the MaroAssembler asserting way later on move / add when handed a huge immediate.
Created attachment 308108 [details] patch
Comment on attachment 308108 [details] patch Clearing flags on attachment: 308108 Committed r215743: <http://trac.webkit.org/changeset/215743>
All reviewed patches have been landed. Closing bug.