...
GetByVal now occasionally takes a fourth child, a dependency from CheckInBounds. See https://trac.webkit.org/changeset/241228/webkit