That was an interesting one. When performing a tail call, we are stack-aligning the *top* of the caller frame instead of stack-aligning the *bottom* of that frame. This means that when we do a tail call with a different parity from the parity of the tail caller, we are overwriting part of the tail caller's caller locals. Patch forthcoming.
Created attachment 258082 [details] Patch
Let's actually implement a full fix.
Created attachment 258108 [details] Patch
Comment on attachment 258108 [details] Patch r=me Do add the call varargs test as we discussed.
Commited in r187767 <http://trac.webkit.org/changeset/187767>.