Oops, forgot about proxy blocks for replace jal.

Also fix a crash when they are used.

Core/MIPS/JitCommon/JitBlockCache.cpp

@@ -188,6 +188,9 @@ void JitBlockCache::ProxyBlock(u32 rootAddress, u32 startAddress, u32 size, cons
 	}
 	b.exitAddress[0] = rootAddress;
 	b.blockNum = num_blocks_;
+	if (!b.proxyFor) {
+		b.proxyFor = new std::vector<u32>();
+	}
 	b.SetPureProxy();  // flag as pure proxy block.
 
 	// Make binary searches and stuff work ok

Core/MIPS/JitCommon/JitBlockCache.h

@@ -83,10 +83,11 @@ struct JitBlock {
 	std::vector<u32> *proxyFor;
 
 	bool IsPureProxy() const {
-		return originalFirstOpcode.encoding == 0;
+		return originalFirstOpcode.encoding == 0x68FF0000;
 	}
 	void SetPureProxy() {
-		originalFirstOpcode.encoding = 0;
+		// Magic number that won't be a real opcode.
+		originalFirstOpcode.encoding = 0x68FF0000;
 	}
 };
 

Core/MIPS/x86/Jit.cpp

@@ -445,24 +445,22 @@ bool Jit::ReplaceJalTo(u32 dest) {
 		MIPSReplaceFunc repl = entry->jitReplaceFunc;
 		int cycles = (this->*repl)();
 		js.downcountAmount += cycles;
-		js.compilerPC += 4;
-		// No writing exits, keep going!
-
-		// Add a trigger so that if the inlined code changes, we invalidate this block.
-		// TODO: Correctly determine the size of this block.
-		blocks.ProxyBlock(js.blockStart, dest, 4, GetCodePtr());
-		return true;
 	} else {
 		gpr.SetImm(MIPS_REG_RA, js.compilerPC + 8);
 		CompileDelaySlot(DELAYSLOT_NICE);
 		FlushAll();
 		ABI_CallFunction(entry->replaceFunc);
 		SUB(32, M(&currentMIPS->downcount), R(EAX));
 		js.downcountAmount = 0;  // we just subtracted most of it
-		js.compilerPC += 4;
-		js.compiling = true;
-		return true;
 	}
+
+	js.compilerPC += 4;
+	// No writing exits, keep going!
+
+	// Add a trigger so that if the inlined code changes, we invalidate this block.
+	// TODO: Correctly determine the size of this block.
+	blocks.ProxyBlock(js.blockStart, dest, 4, GetCodePtr());
+	return true;
 }
 
 void Jit::Comp_ReplacementFunc(MIPSOpcode op)