Arguments are not passed correctly for CreateThis and NewObject. The child node is incorrectly "used" by twice for GetbyOffset.
Created attachment 109136 [details]
Comment on attachment 109136 [details]
Clearing flags on attachment: 109136
Committed r96344: <http://trac.webkit.org/changeset/96344>
All reviewed patches have been landed. Closing bug.