This is because GClosure always expects a first parameter as instance. In case of functions or constructors with no parameters we insert a fake instance which is just a null pointer that is just ignored by the callback. But if the function/constructor has user data the callback will expect one parameter for the user data. In thta case we can simply swap instance/user data so that the fake instance will be the second argument and user data the first one.
Created attachment 365530 [details]
Comment on attachment 365530 [details]
Clearing flags on attachment: 365530
Committed r243289: <https://trac.webkit.org/changeset/243289>
All reviewed patches have been landed. Closing bug.