diff --git a/Source/JavaScriptCore/llint/InPlaceInterpreter.asm b/Source/JavaScriptCore/llint/InPlaceInterpreter.asm
index f066459afc3ae..f650915c6500f 100644
--- a/Source/JavaScriptCore/llint/InPlaceInterpreter.asm
+++ b/Source/JavaScriptCore/llint/InPlaceInterpreter.asm
@@ -812,7 +812,8 @@ macro ipintCatchCommon()
     # 1 << 4 == StackValueSize
     lshiftq 4, t0
     addq IPIntCalleeSaveSpaceStackAligned, t0
-    subp cfr, t0, sp
+    subp cfr, t0, t0
+    move t0, sp
 end
 
 global _ipint_catch_entry
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index 7bb46971d3f58..b3b8e7a77a288 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -1101,7 +1101,8 @@ macro restoreStackPointerAfterCall()
         subp cfr, t2, t2
         move t2, sp
     else
-        subp cfr, t2, sp
+        subp cfr, t2, t2
+        move t2, sp
     end
 end
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index abd6f9e4e3146..e6220f45eea1e 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -340,7 +340,8 @@ macro doVMEntry(makeCall)
         subp cfr, CalleeRegisterSaveSize, t5
         move t5, sp
     else
-        subp cfr, CalleeRegisterSaveSize, sp
+        subp cfr, CalleeRegisterSaveSize, t5
+        move t5, sp
     end
 
     popCalleeSaves()
@@ -379,7 +380,8 @@ _llint_throw_stack_overflow_error_from_vm_entry:
         subp cfr, CalleeRegisterSaveSize, t5
         move t5, sp
     else
-        subp cfr, CalleeRegisterSaveSize, sp
+        subp cfr, CalleeRegisterSaveSize, t5
+        move t5, sp
     end
 
     popCalleeSaves()
@@ -452,7 +454,8 @@ op(llint_handle_uncaught_exception, macro()
         subp cfr, CalleeRegisterSaveSize, t3
         move t3, sp
     else
-        subp cfr, CalleeRegisterSaveSize, sp
+        subp cfr, CalleeRegisterSaveSize, t3
+        move t3, sp
     end
 
     popCalleeSaves()
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 03bcfe0deeec5..10c42b71d4b51 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -357,7 +357,8 @@ macro doVMEntry(makeCall)
         storep t2, VM::topEntryFrame[vm]
     end
 
-    subp cfr, CalleeRegisterSaveSize, sp
+    subp cfr, CalleeRegisterSaveSize, t2
+    move t2, sp
 
     popCalleeSaves()
     functionEpilogue()
@@ -383,7 +384,8 @@ _llint_throw_stack_overflow_error_from_vm_entry:
 
     move ValueUndefined, r0
 
-    subp cfr, CalleeRegisterSaveSize, sp
+    subp cfr, CalleeRegisterSaveSize, t4
+    move t4, sp
     popCalleeSaves()
     functionEpilogue()
     ret
@@ -445,7 +447,8 @@ op(llint_handle_uncaught_exception, macro ()
 
     move ValueUndefined, r0
 
-    subp cfr, CalleeRegisterSaveSize, sp
+    subp cfr, CalleeRegisterSaveSize, t3
+    move t3, sp
     popCalleeSaves()
     functionEpilogue()
     ret
diff --git a/Source/JavaScriptCore/llint/WebAssembly.asm b/Source/JavaScriptCore/llint/WebAssembly.asm
index bb255ffa6bb4a..9bcd031f8ed19 100644
--- a/Source/JavaScriptCore/llint/WebAssembly.asm
+++ b/Source/JavaScriptCore/llint/WebAssembly.asm
@@ -381,7 +381,8 @@ if ARMv7
     subp cfr, ws1, ws1
     move ws1, sp
 else
-    subp cfr, ws1, sp
+    subp cfr, ws1, ws1
+    move ws1, sp
 end
 end
 
@@ -1012,7 +1013,8 @@ if ARMv7
             subp cfr, ws1, ws1
             move ws1, sp
 else
-            subp cfr, ws1, sp
+            subp cfr, ws1, ws1
+            move ws1, sp
 end
 
             wgetu(ctx, m_numberOfStackArgs, ws1)
@@ -1169,7 +1171,8 @@ if ARMv7
             subp cfr, ws1, ws1
             move ws1, sp
 else
-            subp cfr, ws1, sp
+            subp cfr, ws1, ws1
+            move ws1, sp
 end
 
             storeWasmInstance(targetWasmInstance)