Merge WebKit at r66666 : Initial merge by git.

Change-Id: I57dedeb49859adc9c539e760f0e749768c66626f

12 files changed, 82 insertions, 138 deletions

diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index e49ca28..28269ff 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -146,6 +146,20 @@ static void putProperty(ExecState* exec, JSObject* obj, const Identifier& proper
     obj->put(exec, propertyName, value, slot);
 }
 
+static unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument, unsigned length, unsigned undefinedValue = 0)
+{
+    JSValue value = exec->argument(argument);
+    if (value.isUndefined())
+        return undefinedValue;
+
+    double indexDouble = value.toInteger(exec);
+    if (indexDouble < 0) {
+        indexDouble += length;
+        return indexDouble < 0 ? 0 : static_cast<unsigned>(indexDouble);
+    }
+    return indexDouble > length ? length : static_cast<unsigned>(indexDouble);
+}
+
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -249,8 +263,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
     if (arrayVisitedElements.size() >= MaxSmallThreadReentryDepth) {
@@ -323,7 +336,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
     JSArray* arr = constructEmptyArray(exec);
-    int n = 0;
+    unsigned n = 0;
     JSValue curArg = thisValue.toThisObject(exec);
     size_t i = 0;
     size_t argCount = exec->argumentCount();
@@ -389,8 +402,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned middle = length / 2;
 
@@ -414,8 +426,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     JSValue result;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
@@ -442,43 +453,19 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
     // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
-
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     // We return a new array
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    double begin = exec->argument(0).toInteger(exec);
+
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    if (begin >= 0) {
-        if (begin > length)
-            begin = length;
-    } else {
-        begin += length;
-        if (begin < 0)
-            begin = 0;
-    }
-    double end;
-    if (exec->argument(1).isUndefined())
-        end = length;
-    else {
-        end = exec->argument(1).toInteger(exec);
-        if (end < 0) {
-            end += length;
-            if (end < 0)
-                end = 0;
-        } else {
-            if (end > length)
-                end = length;
-        }
-    }
+    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
+    unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, length, length);
 
-    int n = 0;
-    int b = static_cast<int>(begin);
-    int e = static_cast<int>(end);
-    for (int k = b; k < e; k++, n++) {
+    unsigned n = 0;
+    for (unsigned k = begin; k < end; k++, n++) {
         if (JSValue v = getProperty(exec, thisObj, k))
             resObj->put(exec, n, v);
     }
@@ -488,8 +475,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -547,29 +533,26 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     // 15.4.4.12
 
-    // FIXME: Firefox returns an empty array.
     if (!exec->argumentCount())
-        return JSValue::encode(jsUndefined());
+        return JSValue::encode(constructEmptyArray(exec));
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    double relativeBegin = exec->argument(0).toInteger(exec);
-    unsigned begin;
-    if (relativeBegin < 0) {
-        relativeBegin += length;
-        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
-    } else
-        begin = std::min<unsigned>(static_cast<unsigned>(relativeBegin), length);
-
-    unsigned deleteCount;
-    if (exec->argumentCount() > 1)
-        deleteCount = std::min<int>(std::max<int>(exec->argument(1).toUInt32(exec), 0), length - begin);
-    else
-        deleteCount = length - begin;
+    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
+
+    unsigned deleteCount = length - begin;
+    if (exec->argumentCount() > 1) {
+        double deleteDouble = exec->argument(1).toInteger(exec);
+        if (deleteDouble < 0)
+            deleteCount = 0;
+        else if (deleteDouble > length - begin)
+            deleteCount = length - begin;
+        else
+            deleteCount = static_cast<unsigned>(deleteDouble);
+    }
 
     JSArray* resObj = new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
     JSValue result = resObj;
@@ -616,8 +599,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     // 15.4.4.13
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
@@ -643,8 +625,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -702,8 +683,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -760,8 +740,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -817,8 +796,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -863,8 +841,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -917,8 +894,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     
     JSValue function = exec->argument(0);
     CallData callData;
@@ -988,8 +964,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     
     JSValue function = exec->argument(0);
     CallData callData;
@@ -1058,23 +1033,12 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
     // JavaScript 1.5 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
-    JSObject* thisObj = thisValue.toThisObject(exec);
-
-    unsigned index = 0;
-    double d = exec->argument(1).toInteger(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    if (d < 0)
-        d += length;
-    if (d > 0) {
-        if (d > length)
-            index = length;
-        else
-            index = static_cast<unsigned>(d);
-    }
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
 
     JSValue searchElement = exec->argument(0);
     for (; index < length; ++index) {
@@ -1090,32 +1054,36 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
 {
-    JSValue thisValue = exec->hostThisValue();
     // JavaScript 1.6 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
-
-    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    int index = length - 1;
-    double d = exec->argument(1).toIntegerPreserveNaN(exec);
-
-    if (d < 0) {
-        d += length;
-        if (d < 0)
-            return JSValue::encode(jsNumber(exec, -1));
+    if (!length)
+        return JSValue::encode(jsNumber(exec, -1));
+
+    unsigned index = length - 1;
+    JSValue fromValue = exec->argument(1);
+    if (!fromValue.isUndefined()) {
+        double fromDouble = fromValue.toInteger(exec);
+        if (fromDouble < 0) {
+            fromDouble += length;
+            if (fromDouble < 0)
+                return JSValue::encode(jsNumber(exec, -1));
+        }
+        if (fromDouble < length)
+            index = static_cast<unsigned>(fromDouble);
     }
-    if (d < length)
-        index = static_cast<int>(d);
 
     JSValue searchElement = exec->argument(0);
-    for (; index >= 0; --index) {
+    do {
+        ASSERT(index < length);
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
         if (JSValue::strictEqual(exec, searchElement, e))
             return JSValue::encode(jsNumber(exec, index));
-    }
+    } while (index--);
 
     return JSValue::encode(jsNumber(exec, -1));
 }
diff --git a/JavaScriptCore/runtime/ErrorInstance.cpp b/JavaScriptCore/runtime/ErrorInstance.cpp
index be6d0fb..740e20e 100644
--- a/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -25,9 +25,10 @@ namespace JSC {
 
 const ClassInfo ErrorInstance::info = { "Error", 0, 0, 0 };
 
-ErrorInstance::ErrorInstance(NonNullPassRefPtr<Structure> structure)
+ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
 {
+    putDirect(globalData->propertyNames->message, jsString(globalData, ""));
 }
 
 ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
@@ -44,7 +45,7 @@ ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, NonNullPassRefPtr
 ErrorInstance* ErrorInstance::create(ExecState* exec, NonNullPassRefPtr<Structure> structure, JSValue message)
 {
     if (message.isUndefined())
-        return new (exec) ErrorInstance(structure);
+        return new (exec) ErrorInstance(&exec->globalData(), structure);
     return new (exec) ErrorInstance(&exec->globalData(), structure, message.toString(exec));
 }
 
diff --git a/JavaScriptCore/runtime/ErrorInstance.h b/JavaScriptCore/runtime/ErrorInstance.h
index 35edcb0..a49cc3c 100644
--- a/JavaScriptCore/runtime/ErrorInstance.h
+++ b/JavaScriptCore/runtime/ErrorInstance.h
@@ -35,7 +35,7 @@ namespace JSC {
         static ErrorInstance* create(ExecState* exec, NonNullPassRefPtr<Structure>, JSValue message);
 
     protected:
-        explicit ErrorInstance(NonNullPassRefPtr<Structure>);
+        explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>);
         explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
     };
 
diff --git a/JavaScriptCore/runtime/ErrorPrototype.cpp b/JavaScriptCore/runtime/ErrorPrototype.cpp
index 0e14a30..d18e7d8 100644
--- a/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -36,7 +36,7 @@ static EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*);
 
 // ECMA 15.9.4
 ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
-    : ErrorInstance(&exec->globalData(), structure, "Unknown error")
+    : ErrorInstance(&exec->globalData(), structure)
 {
     // The constructor will be added later in ErrorConstructor's constructor
 
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.cpp b/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 871b2d5..9a6fe5e 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -187,11 +187,6 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     return exception;
 }
 
-JSObject* createOutOfMemoryError(JSGlobalObject* globalObject)
-{
-    return createError(globalObject, "Out of memory");
-}
-
 JSValue throwOutOfMemoryError(ExecState* exec)
 {
     return throwError(exec, createError(exec, "Out of memory"));
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.h b/JavaScriptCore/runtime/ExceptionHelpers.h
index e4c94fb..3e6de86 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -53,7 +53,6 @@ namespace JSC {
     JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
-    JSObject* createOutOfMemoryError(JSGlobalObject*);
     JSValue throwOutOfMemoryError(ExecState*);
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/Executable.cpp b/JavaScriptCore/runtime/Executable.cpp
index 058a091..41b5f1f 100644
--- a/JavaScriptCore/runtime/Executable.cpp
+++ b/JavaScriptCore/runtime/Executable.cpp
@@ -116,10 +116,6 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
         m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_evalCodeBlock.get());
-         if (UNLIKELY(!m_jitCodeForCall)) {
-             m_evalCodeBlock.clear();
-             return createOutOfMemoryError(globalObject);
-         }
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_evalCodeBlock->discardBytecode();
@@ -168,10 +164,6 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
         m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_programCodeBlock.get());
-         if (UNLIKELY(!m_jitCodeForCall)) {
-             m_programCodeBlock.clear();
-             return createOutOfMemoryError(globalObject);
-         }
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_programCodeBlock->discardBytecode();
@@ -213,10 +205,6 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
         m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
-         if (UNLIKELY(!m_jitCodeForCall)) {
-             m_codeBlockForCall.clear();
-             return createOutOfMemoryError(globalObject);
-         }
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_codeBlockForCall->discardBytecode();
@@ -258,10 +246,6 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
         m_jitCodeForConstruct = JIT::compile(scopeChainNode->globalData, m_codeBlockForConstruct.get(), &m_jitCodeForConstructWithArityCheck);
-         if (UNLIKELY(!m_jitCodeForConstruct)) {
-             m_codeBlockForConstruct.clear();
-             return createOutOfMemoryError(globalObject);
-         }
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_codeBlockForConstruct->discardBytecode();
@@ -305,15 +289,12 @@ PassOwnPtr<ExceptionInfo> FunctionExecutable::reparseExceptionInfo(JSGlobalData*
 #if ENABLE(JIT)
     if (globalData->canUseJIT()) {
         JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get(), 0, codeBlock->m_isConstructor ? generatedJITCodeForConstruct().start() : generatedJITCodeForCall().start());
-        if (!newJITCode) {
-            globalData->functionCodeBlockBeingReparsed = 0;
-            return PassOwnPtr<ExceptionInfo>();
-        }
         ASSERT(codeBlock->m_isConstructor ? newJITCode.size() == generatedJITCodeForConstruct().size() : newJITCode.size() == generatedJITCodeForCall().size());
     }
 #endif
 
     globalData->functionCodeBlockBeingReparsed = 0;
+
     return newCodeBlock->extractExceptionInfo();
 }
 
@@ -338,10 +319,6 @@ PassOwnPtr<ExceptionInfo> EvalExecutable::reparseExceptionInfo(JSGlobalData* glo
 #if ENABLE(JIT)
     if (globalData->canUseJIT()) {
         JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get(), 0, generatedJITCodeForCall().start());
-        if (!newJITCode) {
-            globalData->functionCodeBlockBeingReparsed = 0;
-            return PassOwnPtr<ExceptionInfo>();
-        }
         ASSERT(newJITCode.size() == generatedJITCodeForCall().size());
     }
 #endif
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index 07acb43..43c4bab 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -227,7 +227,6 @@ namespace JSC {
 #endif
 
         CachedTranscendentalFunction<sin> cachedSin;
-        WTF::ThreadSpecific<char*> stackGuards;
 
         void resetDateCache();
 
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index af4b0f4..4a6744d 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -410,7 +410,7 @@ namespace JSC {
     inline uint32_t JSValue::toUInt32(ExecState* exec) const
     {
         if (isUInt32())
-            return asInt32();
+            return asUInt32();
 
         double val = toNumber(exec);
 
diff --git a/JavaScriptCore/runtime/NumberPrototype.cpp b/JavaScriptCore/runtime/NumberPrototype.cpp
index 1a74375..e18553b 100644
--- a/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -29,6 +29,7 @@
 #include "Operations.h"
 #include "PrototypeFunction.h"
 #include "StringBuilder.h"
+#include "dtoa.h"
 #include <wtf/Assertions.h>
 #include <wtf/DecimalNumber.h>
 #include <wtf/MathExtras.h>
diff --git a/JavaScriptCore/runtime/TimeoutChecker.cpp b/JavaScriptCore/runtime/TimeoutChecker.cpp
index 2dc1028..04d904d 100644
--- a/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -98,7 +98,10 @@ static inline unsigned getCPUTime()
     return GETUPTIMEMS();
 #else
     // FIXME: We should return the time the current thread has spent executing.
-    return currentTime() * 1000;
+
+    // use a relative time from first call in order to avoid an overflow
+    static double firstTime = currentTime();
+    return (currentTime() - firstTime) * 1000;
 #endif
 }
 
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 7362950..17cd9b6 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -35,10 +35,10 @@
 #include <stdlib.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
+#include <wtf/DecimalNumber.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
-#include <wtf/text/WTFString.h>
 #include <wtf/unicode/UTF8.h>
 
 #if HAVE(STRINGS_H)
@@ -199,7 +199,8 @@ UString UString::number(long l)
 UString UString::number(double d)
 {
     NumberToStringBuffer buffer;
-    return StringImpl::create(buffer, numberToString(d, buffer));
+    unsigned length = numberToString(d, buffer);
+    return UString(buffer, length);
 }
 
 UString UString::substringSharingImpl(unsigned offset, unsigned length) const