--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -325,18 +325,25 @@ SYMBOL_STRING(JaegerFromTracer) ":"     
     "movl 0x2C(%ebx), %ecx"                 "\n" /* fp->rval type */
     "movl 0x3C(%ebx), %eax"                 "\n" /* fp->ncode */
     "movl 0x1C(%esp), %ebx"                 "\n" /* f.fp */
     "ret"                                   "\n"
 );
 
 # elif defined(JS_CPU_ARM)
 
-JS_STATIC_ASSERT(offsetof(VMFrame, savedLR) == (sizeof(VMFrame)-4));
 JS_STATIC_ASSERT(sizeof(VMFrame) == 80);
+JS_STATIC_ASSERT(offsetof(VMFrame, savedLR) ==          (4*19));
+JS_STATIC_ASSERT(offsetof(VMFrame, entryFp) ==          (4*10));
+JS_STATIC_ASSERT(offsetof(VMFrame, stackLimit) ==       (4*9));
+JS_STATIC_ASSERT(offsetof(VMFrame, cx) ==               (4*8));
+JS_STATIC_ASSERT(offsetof(VMFrame, fp) ==               (4*7));
+JS_STATIC_ASSERT(offsetof(VMFrame, oldRegs) ==          (4*4));
+JS_STATIC_ASSERT(offsetof(VMFrame, previous) ==         (4*3));
+JS_STATIC_ASSERT(offsetof(VMFrame, scriptedReturn) ==   (4*0));
 
 asm volatile (
 ".text\n"
 ".globl " SYMBOL_STRING(JaegerFromTracer)   "\n"
 SYMBOL_STRING(JaegerFromTracer) ":"         "\n"
     /* Restore frame regs. */
     "ldr r11, [sp, #32]"                    "\n"
     "bx  r0"                                "\n"
@@ -358,37 +365,40 @@ SYMBOL_STRING(JaegerTrampoline) ":"     
      *  [ r11       ]   |
      *  [ r10       ]   |
      *  [ r9        ]   | Callee-saved registers.                             
      *  [ r8        ]   | VFP registers d8-d15 may be required here too, but  
      *  [ r7        ]   | unconditionally preserving them might be expensive
      *  [ r6        ]   | considering that we might not use them anyway.
      *  [ r5        ]   |
      *  [ r4        ]   /
-     *  [ ICallCnt  ]
+     *  [ entryFp   ]
+     *  [ stkLimit  ]
      *  [ cx        ]
      *  [ fp        ]
      *  [ regs.sp   ]
      *  [ regs.pc   ]
      *  [ oldRegs   ]
      *  [ previous  ]
      *  [ args.ptr  ]
      *  [ args.ptr2 ]
      *  [ srpt. ret ]   } Scripted return.
      */
     
     /* Push callee-saved registers. TODO: Do we actually need to push all of them? If the
      * compiled JavaScript function is EABI-compliant, we only need to push what we use in
      * JaegerTrampoline. */
 "   push    {r4-r11,lr}"                        "\n"
     /* Push interesting VMFrame content. */
-"   push    {r0,r3}"                            "\n"    /* inlineCallCount, cx */
+"   push    {r1}"                               "\n"    /* entryFp */
+"   push    {r3}"                               "\n"    /* stackLimit */
+"   push    {r0}"                               "\n"    /* cx */
 "   push    {r1}"                               "\n"    /* fp */
     /* Remaining fields are set elsewhere, but we need to leave space for them. */
-"   sub     sp, sp, #(4*8)"                     "\n"
+"   sub     sp, sp, #(4*7)"                     "\n"
 
 "   mov     r0, sp"                             "\n"
 "   mov     r4, r2"                             "\n"    /* Preserve r2 ('code') in a callee-saved register. */
 "   bl  " SYMBOL_STRING_RELOC(SetVMFrameRegs)   "\n"
 "   mov     r0, sp"                             "\n"
 "   bl  " SYMBOL_STRING_RELOC(PushActiveVMFrame)"\n"
 
     /* Call the compiled JavaScript function. We do this with an unaligned sp because the compiled
@@ -399,17 +409,17 @@ SYMBOL_STRING(JaegerTrampoline) ":"     
 
     /* Tidy up. */
 "   mov     r0, sp"                             "\n"
 "   bl  " SYMBOL_STRING_RELOC(PopActiveVMFrame) "\n"
 "   mov     r0, sp"                             "\n"
 "   bl  " SYMBOL_STRING_RELOC(UnsetVMFrameRegs) "\n"
 
     /* Skip past the parameters we pushed (such as cx and the like). */
-"   add     sp, sp, #(4*8 + 4*3)"               "\n"
+"   add     sp, sp, #(4*7 + 4*4)"               "\n"
 
     /* Set a 'true' return value to indicate successful completion. */
 "   mov     r0, #1"                         "\n"
 "   pop     {r4-r11,pc}"                    "\n"
 );
 
 asm volatile (
 ".text\n"
@@ -422,17 +432,17 @@ SYMBOL_STRING(JaegerThrowpoline) ":"    
 "   bl  " SYMBOL_STRING_RELOC(js_InternalThrow) "\n"
     
     /* If 0 was returned, just bail out as normal. Otherwise, we have a 'catch' or 'finally' clause
      * to execute. */
 "   cmp     r0, #0"                         "\n"
 "   bxne    r0"                             "\n"
 
     /* Skip past the parameters we pushed (such as cx and the like). */
-"   add     sp, sp, #(4*8 + 4*3)"               "\n"
+"   add     sp, sp, #(4*7 + 4*4)"           "\n"
 
 "   pop     {r4-r11,pc}"                    "\n"
 );
 
 asm volatile (
 ".text\n"
 ".globl " SYMBOL_STRING(JaegerStubVeneer)   "\n"
 SYMBOL_STRING(JaegerStubVeneer) ":"         "\n"