ARMv7 and therefore the ARMv7Assembler::add() method has a special case for SP destination register. It assumes that any immediate is word aligned. When constant blinding is used, the immediate value could be any value since it starts as a random number. The same is true for ARMv7Assembler::sub().
Created attachment 135652 [details]
Comment on attachment 135652 [details]
Attachment 135652 [details] did not pass win-ews (win):
Created attachment 135702 [details]
Updated Patch with ASSERT Added
Added ASSERTs in ARMv7Assembler::add() and ARMv7Assembler::sub().
These ASSERTs rubber stamped by Oliver.
Committed r113253: <http://trac.webkit.org/changeset/113253>