Patch forthcoming.
Created attachment 247717 [details] the patch
Comment on attachment 247717 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=247717&action=review r=me > Source/JavaScriptCore/ChangeLog:9 > + (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Use shift instead of mul, since mul doesn't automatically strength-reduce to shift. Also lass the structure as a TrustedImmPtr. lass => pass
Landed in http://trac.webkit.org/changeset/180909