ArgumentsObject::create and all its friends are missing proper placement-new of the GCValuePtr before calling init. CopyFrameArgs, CopyJitFrameArgs, CopyScriptFrameIterArgs should probably change their |copy| signatures to be clearer here. Perhaps rename to unitializedCopyArgs (as in std::uninitialized_copy) and remove the JSContext argument. ArgumentsData could probably just have a constructor too.