This is because GClosure always expects a first parameter as instance. In case of functions or constructors with no parameters we insert a fake instance which is just a null pointer that is just ignored by the callback. But if the function/constructor has user data the callback will expect one parameter for the user data. In thta case we can simply swap instance/user data so that the fake instance will be the second argument and user data the first one.
Created attachment 365530 [details] Patch
Comment on attachment 365530 [details] Patch Clearing flags on attachment: 365530 Committed r243289: <https://trac.webkit.org/changeset/243289>
All reviewed patches have been landed. Closing bug.
<rdar://problem/49106784>