The crash in operationArithNegateProfiledOptimize is due to a bug in clang 10/11. On AArch64, the frame pointer might be set incorrectly depending on which registers are saved on the stack. This is fixed in https://github.com/llvm/llvm-project/commit/e9d9a61208, which applies easily on clang 11.
WebKit uses __builtin_frame_address(1) in DECLARE_CALL_FRAME macro, which due to the bug reads a saved floating point register, instead of the frame pointer of the caller.
