diff -up webkitgtk-2.4.9/Source/JavaScriptCore/interpreter/ProtoCallFrame.h.jsc_proto_call_frame webkitgtk-2.4.9/Source/JavaScriptCore/interpreter/ProtoCallFrame.h
--- webkitgtk-2.4.9/Source/JavaScriptCore/interpreter/ProtoCallFrame.h.jsc_proto_call_frame	2016-03-07 10:04:24.425851848 +0100
+++ webkitgtk-2.4.9/Source/JavaScriptCore/interpreter/ProtoCallFrame.h	2016-03-07 10:04:53.193661612 +0100
@@ -36,7 +36,7 @@ struct ProtoCallFrame {
     Register calleeValue;
     Register argCountAndCodeOriginValue;
     Register thisArg;
-    size_t paddedArgCount;
+    uint32_t paddedArgCount;
     JSValue *args;
 
     void init(CodeBlock*, JSScope*, JSObject*, JSValue, int, JSValue* otherArgs = 0);
@@ -53,7 +53,7 @@ struct ProtoCallFrame {
     int argumentCountIncludingThis() const { return argCountAndCodeOriginValue.payload(); }
     int argumentCount() const { return argumentCountIncludingThis() - 1; }
     void setArgumentCountIncludingThis(int count) { argCountAndCodeOriginValue.payload() = count; }
-    void setPaddedArgsCount(size_t argCount) { paddedArgCount = argCount; }
+    void setPaddedArgsCount(uint32_t argCount) { paddedArgCount = argCount; }
 
     void clearCurrentVPC() { argCountAndCodeOriginValue.tag() = 0; }
     
diff -up webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.jsc_proto_call_frame webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
--- webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.jsc_proto_call_frame	2016-03-07 10:05:28.754426456 +0100
+++ webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2016-03-07 10:06:02.349204301 +0100
@@ -266,7 +266,7 @@ macro doCallToJavaScript(makeCall, doRet
     storep previousCFR, CallerFrame[cfr]
     move cfr, temp1
 
-    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], temp2
+    loadi PayloadOffset + ProtoCallFrame::paddedArgCount[protoCallFrame], temp2
     addp CallFrameHeaderSlots, temp2, temp2
     lshiftp 3, temp2
     subp temp2, cfr
diff -up webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.jsc_proto_call_frame webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
--- webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.jsc_proto_call_frame	2016-03-07 10:05:34.843386191 +0100
+++ webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	2016-03-07 10:06:23.245066120 +0100
@@ -157,7 +157,7 @@ macro doCallToJavaScript(makeCall, doRet
     storep previousCFR, CallerFrame[cfr]
     move cfr, temp1
 
-    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], temp2
+    loadi PayloadOffset + ProtoCallFrame::paddedArgCount[protoCallFrame], temp2
     addp CallFrameHeaderSlots, temp2, temp2
     lshiftp 3, temp2
     subp temp2, cfr