--- a/js/src/asmjs/WasmFrameIterator.cpp
+++ b/js/src/asmjs/WasmFrameIterator.cpp
@@ -213,39 +213,39 @@ FrameIterator::lineOrBytecode() const
 // These constants reflect statically-determined offsets in the profiling
 // prologue/epilogue. The offsets are dynamically asserted during code
 // generation.
 #if defined(JS_CODEGEN_X64)
 # if defined(DEBUG)
 static const unsigned PushedRetAddr = 0;
 static const unsigned PostStorePrePopFP = 0;
 # endif
-static const unsigned PushedFP = 16;
-static const unsigned StoredFP = 23;
+static const unsigned PushedFP = 23;
+static const unsigned StoredFP = 30;
 #elif defined(JS_CODEGEN_X86)
 # if defined(DEBUG)
 static const unsigned PushedRetAddr = 0;
 static const unsigned PostStorePrePopFP = 0;
 # endif
-static const unsigned PushedFP = 11;
-static const unsigned StoredFP = 14;
+static const unsigned PushedFP = 14;
+static const unsigned StoredFP = 17;
 #elif defined(JS_CODEGEN_ARM)
 static const unsigned PushedRetAddr = 4;
-static const unsigned PushedFP = 20;
-static const unsigned StoredFP = 24;
+static const unsigned PushedFP = 24;
+static const unsigned StoredFP = 28;
 static const unsigned PostStorePrePopFP = 4;
 #elif defined(JS_CODEGEN_ARM64)
 static const unsigned PushedRetAddr = 0;
 static const unsigned PushedFP = 0;
 static const unsigned StoredFP = 0;
 static const unsigned PostStorePrePopFP = 0;
 #elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
 static const unsigned PushedRetAddr = 8;
-static const unsigned PushedFP = 28;
-static const unsigned StoredFP = 32;
+static const unsigned PushedFP = 32;
+static const unsigned StoredFP = 36;
 static const unsigned PostStorePrePopFP = 4;
 #elif defined(JS_CODEGEN_NONE)
 # if defined(DEBUG)
 static const unsigned PushedRetAddr = 0;
 static const unsigned PostStorePrePopFP = 0;
 # endif
 static const unsigned PushedFP = 1;
 static const unsigned StoredFP = 1;
@@ -276,25 +276,25 @@ GenerateProfilingPrologue(MacroAssembler
 
     // ProfilingFrameIterator needs to know the offsets of several key
     // instructions from entry. To save space, we make these offsets static
     // constants and assert that they match the actual codegen below. On ARM,
     // this requires AutoForbidPools to prevent a constant pool from being
     // randomly inserted between two instructions.
     {
 #if defined(JS_CODEGEN_ARM)
-        AutoForbidPools afp(&masm, /* number of instructions in scope = */ 6);
+        AutoForbidPools afp(&masm, /* number of instructions in scope = */ 7);
 #endif
 
         offsets->begin = masm.currentOffset();
 
         PushRetAddr(masm);
         MOZ_ASSERT_IF(!masm.oom(), PushedRetAddr == masm.currentOffset() - offsets->begin);
 
-        masm.loadWasmActivationFromTls(scratch);
+        masm.loadWasmActivationFromSymbolicAddress(scratch);
         masm.push(Address(scratch, WasmActivation::offsetOfFP()));
         MOZ_ASSERT_IF(!masm.oom(), PushedFP == masm.currentOffset() - offsets->begin);
 
         masm.storePtr(masm.getStackPointer(), Address(scratch, WasmActivation::offsetOfFP()));
         MOZ_ASSERT_IF(!masm.oom(), StoredFP == masm.currentOffset() - offsets->begin);
     }
 
     if (reason != ExitReason::None)
@@ -313,17 +313,17 @@ GenerateProfilingEpilogue(MacroAssembler
 #if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_ARM64) || \
     defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
     Register scratch2 = ABINonArgReturnReg1;
 #endif
 
     if (framePushed)
         masm.addToStackPtr(Imm32(framePushed));
 
-    masm.loadWasmActivationFromTls(scratch);
+    masm.loadWasmActivationFromSymbolicAddress(scratch);
 
     if (reason != ExitReason::None) {
         masm.store32(Imm32(int32_t(ExitReason::None)),
                      Address(scratch, WasmActivation::offsetOfExitReason()));
     }
 
     // ProfilingFrameIterator assumes fixed offsets of the last few
     // instructions from profilingReturn, so AutoForbidPools to ensure that

--- a/js/src/asmjs/WasmJS.cpp
+++ b/js/src/asmjs/WasmJS.cpp
@@ -50,16 +50,23 @@ wasm::HasCompilerSupport(ExclusiveContex
         return false;
 
     if (!cx->jitSupportsUnalignedAccesses())
         return false;
 
     if (!wasm::HaveSignalHandlers())
         return false;
 
+#if defined(JS_CODEGEN_ARM)
+    // movw/t are required for the loadWasmActivationFromSymbolicAddress in
+    // GenerateProfilingPrologue/Epilogue to avoid using the constant pool.
+    if (!HasMOVWT())
+        return false;
+#endif
+
 #if defined(JS_CODEGEN_NONE) || defined(JS_CODEGEN_ARM64)
     return false;
 #else
     return true;
 #endif
 }
 
 template<typename T>

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/no-movwt.js
@@ -0,0 +1,8 @@
+setARMHwCapFlags('vfp');
+
+if (typeof WebAssembly !== "undefined") {
+    var i = new WebAssembly.Instance(
+                new WebAssembly.Module(
+                    wasmTextToBinary('(module (func (export "") (result i32) (i32.const 42)))')));
+    assertEq(i.exports[""](), 42);
+}