diff -up webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_32 webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
--- webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_32	2013-08-28 21:06:29.000000000 +0200
+++ webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2013-09-12 15:32:34.000000000 +0200
@@ -1679,7 +1679,7 @@ _llint_op_next_pname:
     loadi 20[PC], t2
     loadi PayloadOffset[cfr, t2, 8], t2
     loadp JSPropertyNameIterator::m_jsStrings[t2], t3
-    loadi [t3, t0, 8], t3
+    loadi PayloadOffset[t3, t0, 8], t3
     addi 1, t0
     storei t0, PayloadOffset[cfr, t1, 8]
     loadi 4[PC], t1
diff -up webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_32 webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
--- webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_32	2013-08-28 21:06:29.000000000 +0200
+++ webkitgtk-2.4.5/Source/JavaScriptCore/llint/LowLevelInterpreter.asm	2013-09-12 15:32:34.000000000 +0200
@@ -276,13 +276,13 @@ macro assertNotConstant(index)
 end
 
 macro functionForCallCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    loadp Callee + PayloadOffset[cfr], targetRegister
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
 end
 
 macro functionForConstructCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    loadp Callee + PayloadOffset[cfr], targetRegister
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
 end