We have a confusing convention where our callOperation() methods in DFG::SpeculativeJIT take the tag GPR first and the payload GPR second, but then reverse them. The transition stub generation code uses a lower level API where the reversal would already have been performed, but I had modeled the code around the calls to callOperation(). Hence I had gotten it backwards.
Created attachment 152916 [details] the patch
Reviewed by Gavin in person.
Landed in http://trac.webkit.org/changeset/122919