JSC::Arguments has an OwnPtr<ArgumentsData> as a member but the destructor is never invoked due to Arguments being a JSCell subclass. This means that the ArgumentsData instances are never deallocated.
Created attachment 121221 [details]
From my reading of the code, this looks like the correct fix. Testing shows that the leaks go away. I'm taking that as a positive sign!
Comment on attachment 121221 [details]
I concur. Looks good.
Fixed in r104119.