--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -471,16 +471,22 @@ MacroAssemblerMIPS::ma_addu(Register rd,
         as_addiu(rd, rs, imm.value);
     } else {
         ma_li(ScratchRegister, imm);
         as_addu(rd, rs, ScratchRegister);
     }
 }
 
 void
+MacroAssemblerMIPS::ma_addu(Register rd, Register rs, Register rt)
+{
+    as_addu(rd, rs, rt);
+}
+
+void
 MacroAssemblerMIPS::ma_addu(Register rd, Register rs)
 {
     as_addu(rd, rd, rs);
 }
 
 void
 MacroAssemblerMIPS::ma_addu(Register rd, Imm32 imm)
 {
@@ -3678,17 +3684,17 @@ MacroAssemblerMIPSCompat::branchValueIsN
 
     branchTestObject(Assembler::NotEqual, value, cond == Assembler::Equal ? &done : label);
     branchPtrInNurseryRange(cond, value.payloadReg(), temp, label);
 
     bind(&done);
 }
 
 void
-MacroAssemblerMIPSCompat::profilerEnterFrame(Register reg)
+MacroAssemblerMIPSCompat::profilerEnterFrame(Register framePtr, Register scratch)
 {
     AbsoluteAddress activation(GetJitContext()->runtime->addressOfProfilingActivation());
     loadPtr(activation, scratch);
     storePtr(framePtr, Address(scratch, JitActivation::offsetOfLastProfilingFrame()));
     storePtr(ImmPtr(nullptr), Address(scratch, JitActivation::offsetOfLastProfilingCallSite()));
 }
 
 void

--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -179,16 +179,17 @@ class MacroAssemblerMIPS : public Assemb
         if (address.offset) {
             ma_addu(dest, dest, Imm32(address.offset));
         }
     }
 
     // arithmetic based ops
     // add
     void ma_addu(Register rd, Register rs, Imm32 imm);
+    void ma_addu(Register rd, Register rs, Register rt);
     void ma_addu(Register rd, Register rs);
     void ma_addu(Register rd, Imm32 imm);
     void ma_addTestOverflow(Register rd, Register rs, Register rt, Label *overflow);
     void ma_addTestOverflow(Register rd, Register rs, Imm32 imm, Label *overflow);
 
     // subtract
     void ma_subu(Register rd, Register rs, Register rt);
     void ma_subu(Register rd, Register rs, Imm32 imm);

--- a/js/src/jit/mips/Trampoline-mips.cpp
+++ b/js/src/jit/mips/Trampoline-mips.cpp
@@ -269,17 +269,17 @@ JitRuntime::generateEnterJIT(JSContext *
         // If OSR-ing, then emit instrumentation for setting lastProfilerFrame
         // if profiler instrumentation is enabled.
         {
             Label skipProfilingInstrumentation;
             Register realFramePtr = numStackValues;
             AbsoluteAddress addressOfEnabled(cx->runtime()->spsProfiler.addressOfEnabled());
             masm.branch32(Assembler::Equal, addressOfEnabled, Imm32(0),
                           &skipProfilingInstrumentation);
-            masm.ma_add(realFramePtr, StackPointer, Imm32(sizeof(void*)));
+            masm.ma_addu(realFramePtr, StackPointer, Imm32(sizeof(void*)));
             masm.profilerEnterFrame(realFramePtr, scratch);
             masm.bind(&skipProfilingInstrumentation);
         }
 
         masm.jump(jitcode);
 
         // OOM: load error value, discard return address and previous frame
         // pointer and return.
@@ -1038,17 +1038,17 @@ JitRuntime::generateBailoutTailStub(JSCo
 JitCode *
 JitRuntime::generateProfilerExitFrameTailStub(JSContext *cx)
 {
     MacroAssembler masm;
 
     Register scratch1 = t0;
     Register scratch2 = t1;
     Register scratch3 = t2;
-    Register scratch3 = t3;
+    Register scratch4 = t3;
 
     //
     // The code generated below expects that the current stack pointer points
     // to an Ion or Baseline frame, at the state it would be immediately
     // before a ret().  Thus, after this stub's business is done, it executes
     // a ret() and returns directly to the caller script, on behalf of the
     // callee script that jumped to this code.
     //
@@ -1156,18 +1156,18 @@ JitRuntime::generateProfilerExitFrameTai
 
         // returning directly to an IonJS frame.  Store return addr to frame
         // in lastProfilingCallSite.
         masm.loadPtr(Address(StackPointer, JitFrameLayout::offsetOfReturnAddress()), scratch2);
         masm.storePtr(scratch2, lastProfilingCallSite);
 
         // Store return frame in lastProfilingFrame.
         // scratch2 := StackPointer + Descriptor.size*1 + JitFrameLayout::Size();
-        masm.ma_add(scratch2, StackPointer, scratch1);
-        masm.ma_add(scratch2, scratch2, Imm32(JitFrameLayout::Size()));
+        masm.ma_addu(scratch2, StackPointer, scratch1);
+        masm.ma_addu(scratch2, scratch2, Imm32(JitFrameLayout::Size()));
         masm.storePtr(scratch2, lastProfilingFrame);
         masm.ret();
     }
 
     //
     // JitFrame_BaselineStub
     //
     // Look past the stub and store the frame pointer to
@@ -1190,17 +1190,17 @@ JitRuntime::generateProfilerExitFrameTai
     //    FP -----> ReturnAddr          |
     //
     // We take advantage of the fact that the stub frame saves the frame
     // pointer pointing to the baseline frame, so a bunch of calculation can
     // be avoided.
     //
     masm.bind(&handle_BaselineStub);
     {
-        masm.ma_add(scratch3, StackPointer, scratch1);
+        masm.ma_addu(scratch3, StackPointer, scratch1);
         Address stubFrameReturnAddr(scratch3,
                                     JitFrameLayout::Size() +
                                     BaselineStubFrameLayout::offsetOfReturnAddress());
         masm.loadPtr(stubFrameReturnAddr, scratch2);
         masm.storePtr(scratch2, lastProfilingCallSite);
 
         Address stubFrameSavedFramePtr(scratch3,
                                        JitFrameLayout::Size() - (2 * sizeof(void *)));
@@ -1247,20 +1247,20 @@ JitRuntime::generateProfilerExitFrameTai
     //              ActualArgc      |
     //              CalleeToken     |- JitFrameLayout::Size()
     //              Descriptor      |
     //    FP -----> ReturnAddr      |
     //
     masm.bind(&handle_Rectifier);
     {
         // scratch2 := StackPointer + Descriptor.size*1 + JitFrameLayout::Size();
-        masm.ma_add(scratch2, StackPointer, scratch1);
+        masm.ma_addu(scratch2, StackPointer, scratch1);
         masm.add32(Imm32(JitFrameLayout::Size()), scratch2);
         masm.loadPtr(Address(scratch2, RectifierFrameLayout::offsetOfDescriptor()), scratch3);
-        masm.ma_lsr(scratch1, scratch3, Imm32(FRAMESIZE_SHIFT));
+        masm.ma_srl(scratch1, scratch3, Imm32(FRAMESIZE_SHIFT));
         masm.and32(Imm32((1 << FRAMETYPE_BITS) - 1), scratch3);
 
         // Now |scratch1| contains Rect-Descriptor.Size
         // and |scratch2| points to Rectifier frame
         // and |scratch3| contains Rect-Descriptor.Type
 
         // Check for either Ion or BaselineStub frame.
         Label handle_Rectifier_BaselineStub;
@@ -1268,32 +1268,32 @@ JitRuntime::generateProfilerExitFrameTai
                       &handle_Rectifier_BaselineStub);
 
         // Handle Rectifier <- IonJS
         // scratch3 := RectFrame[ReturnAddr]
         masm.loadPtr(Address(scratch2, RectifierFrameLayout::offsetOfReturnAddress()), scratch3);
         masm.storePtr(scratch3, lastProfilingCallSite);
 
         // scratch3 := RectFrame + Rect-Descriptor.Size + RectifierFrameLayout::Size()
-        masm.ma_add(scratch3, scratch2, scratch1);
+        masm.ma_addu(scratch3, scratch2, scratch1);
         masm.add32(Imm32(RectifierFrameLayout::Size()), scratch3);
         masm.storePtr(scratch3, lastProfilingFrame);
         masm.ret();
 
         // Handle Rectifier <- BaselineStub <- BaselineJS
         masm.bind(&handle_Rectifier_BaselineStub);
 #ifdef DEBUG
         {
             Label checkOk;
             masm.branch32(Assembler::Equal, scratch3, Imm32(JitFrame_BaselineStub), &checkOk);
             masm.assumeUnreachable("Unrecognized frame preceding baselineStub.");
             masm.bind(&checkOk);
         }
 #endif
-        masm.ma_add(scratch3, scratch2, scratch1);
+        masm.ma_addu(scratch3, scratch2, scratch1);
         Address stubFrameReturnAddr(scratch3, RectifierFrameLayout::Size() +
                                               BaselineStubFrameLayout::offsetOfReturnAddress());
         masm.loadPtr(stubFrameReturnAddr, scratch2);
         masm.storePtr(scratch2, lastProfilingCallSite);
 
         Address stubFrameSavedFramePtr(scratch3,
                                        RectifierFrameLayout::Size() - (2 * sizeof(void *)));
         masm.loadPtr(stubFrameSavedFramePtr, scratch2);