JSC::Arguments has an OwnPtr<ArgumentsData> as a member but the destructor is never invoked due to Arguments being a JSCell subclass. This means that the ArgumentsData instances are never deallocated.
Created attachment 121221 [details] Patch v1 From my reading of the code, this looks like the correct fix. Testing shows that the leaks go away. I'm taking that as a positive sign!
Comment on attachment 121221 [details] Patch v1 I concur. Looks good.
<rdar://problem/10647206>
Fixed in r104119.