Hi, The patch looks correct, however I would suggest to rewrite this bit of the code urgently in separate patch as it is way too complex to assert it is now bug free - there are too many possible failure scenarios to list... Also it generates quite inefficient code - pushable_regs should include R0-R3 minus the arguments plus LR (if LR was already saved).
Also it is important to keep track of which registers still need to be saved, and never use pushable_regs for two separate purposes. Finally it seems a good idea to check the 2 masks passed to thumb1_emit_multi_reg_push have the same number of set bits - that would have prevented this bug from ever happening. Wilco