On 32-bit, we should use TimesEight (8) instead of ScalePtr (4) to compute the address of a JS array element.
Created attachment 110262 [details] the patch
Oops!
r=me Did you want cq+?
Comment on attachment 110262 [details] the patch Yes. Thanks.
Comment on attachment 110262 [details] the patch Clearing flags on attachment: 110262 Committed r97003: <http://trac.webkit.org/changeset/97003>
All reviewed patches have been landed. Closing bug.