After much more investigation time than I would like to admit, I found a small and obvious error resulting in us reading from memory we're not supposed to in the API tests.
Created attachment 253468 [details] Patch
http://trac.webkit.org/changeset/184668
This patch doesn't seem to change any results, how is that possible?
(In reply to comment #3) > This patch doesn't seem to change any results, how is that possible? Before this patch, we had a StringView pointing to deallocated data that was almost certainly still there because we had just deallocated it and reallocated a new string with a different length.