If you use a loop in the style of: for (i = start; i--;) then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'. Hence the following is probably wrong: for (i = start - 1; i--;)
Created attachment 145390 [details] the patch
Landed in http://trac.webkit.org/changeset/119292