The FTL code to compile outgoing calls uses the B3 function, requestCallArgAreaSize(), to assure there is enough stack space to make the call. In one instance the call is made with a argument in bytes, while the other two instances use count of JSValue sized objects. Reading the code in B3 and Air shows that the value should be in bytes. Therefore those two instances are wrong.
Created attachment 289414 [details] Patch
Comment on attachment 289414 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=289414&action=review r=me > Source/JavaScriptCore/ChangeLog:14 > + No new tests as this doesn't surface as an issue when arguments are pass on the stack. passed
Committed r206212: <http://trac.webkit.org/changeset/206212>