Merge Webkit at r70949: Initial merge by git.

Change-Id: I77b8645c083b5d0da8dba73ed01d4014aab9848e

85 files changed, 1561 insertions, 899 deletions

diff --git a/JavaScriptCore/API/APICast.h b/JavaScriptCore/API/APICast.h
index ba00d02..4294d3d 100644
--- a/JavaScriptCore/API/APICast.h
+++ b/JavaScriptCore/API/APICast.h
@@ -111,8 +111,8 @@ inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
     if (!v)
         return 0;
     if (!v.isCell())
-        return reinterpret_cast<JSValueRef>(asCell(JSC::jsAPIValueWrapper(exec, v)));
-    return reinterpret_cast<JSValueRef>(asCell(v));
+        return reinterpret_cast<JSValueRef>(JSC::jsAPIValueWrapper(exec, v).asCell());
+    return reinterpret_cast<JSValueRef>(v.asCell());
 #else
     UNUSED_PARAM(exec);
     return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
diff --git a/JavaScriptCore/API/JSValueRef.cpp b/JavaScriptCore/API/JSValueRef.cpp
index c22e8d8..b8dd7c6 100644
--- a/JavaScriptCore/API/JSValueRef.cpp
+++ b/JavaScriptCore/API/JSValueRef.cpp
@@ -219,7 +219,7 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
     if (isnan(value))
         value = NaN;
 
-    return toRef(exec, jsNumber(exec, value));
+    return toRef(exec, jsNumber(value));
 }
 
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 95bf475..7b935d4 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,771 @@
+2010-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
+        https://bugs.webkit.org/show_bug.cgi?id=47573
+
+        I think the interpreter portion of this was introduced by
+        an incorrect but silent merge when I updated prior to committing.
+        The JIT change is basically just a correctness fix, but it is
+        needed to prevent the testcase from asserting in debug builds.
+
+        The basic problem is incorrectly setting the activation object
+        on an arguments object.  The crash was due to us setting a null
+        activation in the interpreter, in the jit we were setting the
+        activation of a strict mode arguments object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * wtf/Platform.h:
+
+2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben and David Kilzer.
+
+        Fix and cleanup of build systems
+        https://bugs.webkit.org/show_bug.cgi?id=48342
+
+        * Configurations/FeatureDefines.xcconfig: Add missing ENABLE_FULLSCREEN_API
+
+2010-10-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Include stddef.h unconditionally in Assertions.h
+        https://bugs.webkit.org/show_bug.cgi?id=48573
+
+        There is no reason to have stddef.h include be MSVC-only.
+
+        * wtf/Assertions.h:
+
+2010-10-28  Herczeg Zoltan  <zherczeg@webkit.org>
+
+        Rubber stamped by Csaba Osztrogonác.
+
+        Try to fix interpreter build.
+
+        Needed parentheses around assignment to avoid GCC warning after
+        http://trac.webkit.org/changeset/70703
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-28  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        resetAssertionMatches() is an unused function in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=48503
+
+        The resetAssertionMatches() function is removed from YARR Interpreter
+        because it's never called.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::resetMatches):
+
+2010-10-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Wrong instruction form for BKPT
+        https://bugs.webkit.org/show_bug.cgi?id=48427
+
+        One '0' is missing from BKPT instruction.
+        Thanks for Jacob Bramley for reporting this error.
+
+        * assembler/ARMAssembler.h:
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Snow Leopard build.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Do not have two different asCell APIs in JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=47979
+
+        Remove JSCell* asCell(JSValue) in favor of only using
+        JSValue::asCell().
+
+        * API/APICast.h:
+        (toRef):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::testPrototype):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::getCallData):
+        (JSC::JSCell::getConstructData):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::asString):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+
+2010-10-27  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support emit_op_mod() for MIPS on JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=46511
+
+        This patch uses MIPS div instructions for op_mod to improve performance.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+
+2010-10-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * wtf/Platform.h: Make sure ACCELERATED_COMPOSITING is
+        turned off in the WinCairo port.  This isn't supported (yet.)
+
+2010-10-27  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) to build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=48279
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Windows build fix.
+
+        * jit/JITStubs.cpp:
+        (JSC::jitThrow):
+
+2010-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 48365 - Remove output parameters from JITStackFrame
+
+        The JIT stub functions presently use the stackframe to provide a couple of additional return values.
+          * In the case of uncaught exceptions the exception value is returned on the stackframe.exception property.
+          * In the case of caught exceptions the updated value for the callFrame register is returned on the stackframe.callFrame property.
+
+        Change exception returns such that exceptions are always returned on JSGlobalData::exception.
+        Change op_catch such that the new CallFrame value is returned from op_throw / vm_throw in regT0.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::jitThrow):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48060
+        Speed up op_jeq_null and op_jneq_null.
+
+        For both opcodes the NullTag and UndefinedTag are checked to control the
+        jump. These values can be simply checked by AboveOrEqual or Below
+        condition if they are the two highest unsigned integers from JSValue's
+        Tag field.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        * runtime/JSValue.h:
+
+2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
+        in the CallFrame of a host call, like the Interpreter does, instead of
+        leaving the CodeBlock field uninitialized. The backtracing code requires
+        a valid CodeBlock field in each CallFrame.
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add cmn to branch32(reg, imm) on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=48062
+
+        The conditional comparison can be done with cmn if the imm value is
+        negative and can fit into the cmn instruction.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+
+2010-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Interpreter build fix.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove exec and globalData arguments from jsNumber
+        https://bugs.webkit.org/show_bug.cgi?id=48270
+
+        Remove the now unused exec and globalData arguments from jsNumber
+        and mechanically update all users of jsNumber.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionRun):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::operator()):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/Error.cpp:
+        (JSC::addErrorSourceInfo):
+        (JSC::addErrorDivotInfo):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::PropertyNameForFunctionCall::value):
+        (JSC::JSONStringify):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSValue.h:
+        (JSC::jsDoubleNumber):
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::toJSNumber):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectLastIndex):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncLocaleCompare):
+
+2010-10-25  David Tapuska  <dtapuska@rim.com>
+
+        Reviewed by David Kilzer.
+
+        Enable VFP if our compiler settings indicated we had a hardware
+        VFP.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46096
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+
+2010-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70451.
+        http://trac.webkit.org/changeset/70451
+        https://bugs.webkit.org/show_bug.cgi?id=48249
+
+        Broke set-unloaded-frame-location.html under Qt (Requested by
+        caseq on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace _countof with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48229
+
+        * wtf/Platform.h:
+
+2010-10-25  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        Check endianness with __BIG_ENDIAN in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=46122
+
+        RVCT defines __BIG_ENDIAN if compiling for a big-endian target.
+
+        * wtf/Platform.h:
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Dave Kilzer.
+
+        Removed empty directories.
+
+        * JavaScriptCore: Removed.
+        * JavaScriptCore/runtime: Removed.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, fix typo of last build fix.
+
+        * wtf/DateMath.cpp:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for chromium.
+
+        * wtf/DateMath.cpp: Added missing include.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add WTF_ARRAY_LENGTH macro to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=32828
+
+        Unify the different implementations and usages.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        * wtf/StdLibExtras.h:
+
+2010-10-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Filter example Chiseled from SVG Wow! is slow
+        https://bugs.webkit.org/show_bug.cgi?id=48174
+
+        Added 'using WTF::ByteArray;' at the end of ByteArray.h
+
+        * wtf/ByteArray.h:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Inline WTF::bitwise_cast and fix style
+        https://bugs.webkit.org/show_bug.cgi?id=48208
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast):
+        (WTF::bitCount):
+
+2010-10-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Unify globalData APIs
+        https://bugs.webkit.org/show_bug.cgi?id=47969
+
+        Make JSGlobalObject::globalData return a reference and adapt
+        callers. This unifies the API with the existing
+        CallFrame::globalData, which also returns a reference.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/JSParser.cpp:
+        (JSC::jsParse):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::globalData):
+
+2010-10-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r70369.
+        http://trac.webkit.org/changeset/70369
+        https://bugs.webkit.org/show_bug.cgi?id=47974
+
+        Caused weird artifacts in expected results.
+
+        * wtf/Platform.h:
+
+2010-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Crashes randomly in cairo_scaled_font_destroy
+        https://bugs.webkit.org/show_bug.cgi?id=46794
+
+        Make PlatformRefPtr aware of hashTableDeletedValue. When PlatformRefPtr
+        goes away this should probably be handled in the future via some special
+        hooks in RefCounted (or its contained type).
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::~PlatformRefPtr):
+        (WTF::PlatformRefPtr::clear):
+        (WTF::::operator):
+
+2010-10-22  Adam Roben  <aroben@apple.com>
+
+        Remove the QuartzCorePresent.h mechanism
+
+        This header was used to detect whether QuartzCore headers were present
+        on the system. Everyone should have these headers now so we no longer
+        need to detect.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Remove
+        code to generate QuartzCorePresent.h.
+
+        * wtf/Platform.h: Stop including QuartzCorePresent.h on Windows and
+        collapse all USE_ACCELERATED_COMPOSITING settings into one #ifdef.
+
+2010-10-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70290.
+        http://trac.webkit.org/changeset/70290
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        Undelete Android build files.
+
+        * Android.mk: Added.
+
+2010-10-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        JSC interpreter regressions after r69940
+        https://bugs.webkit.org/show_bug.cgi?id=47839
+
+        Wrong "if": It should test whether the result exists,
+        and not the opposite. It is an interpreter bug, hence
+        the bots does not capture it.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove Android build system
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        * Android.mk: Removed.
+
+2010-10-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a String constructor which takes AECHAR*
+        https://bugs.webkit.org/show_bug.cgi?id=45043
+
+        Add String(const AECHAR*) constructor for convenience.
+
+        * wtf/text/WTFString.h:
+
+2010-10-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use GCharsetConverter instead of g_iconv in TextCodecGtk
+        https://bugs.webkit.org/show_bug.cgi?id=47896
+
+        * wtf/gobject/GTypedefs.h:
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70174.
+        http://trac.webkit.org/changeset/70174
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+
+        This patch reverts a change that causes
+        http/tests/xmlhttprequest/origin-whitelisting-removal.html to crash.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
 2010-10-20  Simon Fraser  <simon.fraser@apple.com>
 
         Fix the EFL build.
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 4c698ce..d08fadf 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -75,6 +75,7 @@ ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
 ENABLE_FILTERS_macosx = ENABLE_FILTERS;
 
 ENABLE_FILE_SYSTEM = ;
+ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
 
 ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME));
@@ -108,6 +109,8 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 
+ENABLE_WEB_AUDIO = ;
+
 ENABLE_WEB_SOCKETS = $(ENABLE_WEB_SOCKETS_$(REAL_PLATFORM_NAME));
 ENABLE_WEB_SOCKETS_macosx = ENABLE_WEB_SOCKETS;
 
@@ -121,4 +124,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
index 85c3152..fafe5c8 100755
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh
@@ -1,15 +1,5 @@
 #!/usr/bin/bash
 
-# Determine if we have QuartzCore so we can turn on
-QUARTZCORE_H_PATH=$(cygpath -u "${WEBKITLIBRARIESDIR}/include/QuartzCore/QuartzCore.h")
-QUARTZCOREPRESENT_H_PATH=$(cygpath -u "${WEBKITOUTPUTDIR}/include/private/QuartzCorePresent.h")
-if test \( ! -f "${QUARTZCOREPRESENT_H_PATH}" \) -o \( -f "${QUARTZCORE_H_PATH}" -a \( "${QUARTZCORE_H_PATH}" -nt "${QUARTZCOREPRESENT_H_PATH}" \) \)
-then
-    mkdir -p "$(dirname "${QUARTZCOREPRESENT_H_PATH}")"
-    test ! -f "${QUARTZCORE_H_PATH}"
-    echo "#define QUARTZCORE_PRESENT $?" > "${QUARTZCOREPRESENT_H_PATH}"
-fi
-
 # Determine whether we have the versioned ICU 4.0 or the unversioned ICU 4.4
 UNVERSIONED_ICU_LIB_PATH=$(cygpath -u "${WEBKITLIBRARIESDIR}/lib/libicuuc.lib")
 ICUVERSION_H_PATH=$(cygpath -u "${WEBKITOUTPUTDIR}/include/private/ICUVersion.h")
diff --git a/JavaScriptCore/assembler/ARMAssembler.h b/JavaScriptCore/assembler/ARMAssembler.h
index dfa726a..900f655 100644
--- a/JavaScriptCore/assembler/ARMAssembler.h
+++ b/JavaScriptCore/assembler/ARMAssembler.h
@@ -165,7 +165,7 @@ namespace JSC {
             VMRS_APSR = 0x0ef1fa10,
 #if WTF_ARM_ARCH_AT_LEAST(5)
             CLZ = 0x016f0f10,
-            BKPT = 0xe120070,
+            BKPT = 0xe1200070,
             BLX = 0x012fff30,
 #endif
 #if WTF_ARM_ARCH_AT_LEAST(7)
@@ -206,7 +206,7 @@ namespace JSC {
         enum {
             padForAlign8  = 0x00,
             padForAlign16 = 0x0000,
-            padForAlign32 = 0xee120070,
+            padForAlign32 = 0xe12fff7f // 'bkpt 0xffff' instruction.
         };
 
         static const ARMWord INVALID_IMM = 0xf0000000;
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index b5b20fa..2db5df1 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -57,7 +57,11 @@ static bool isVFPPresent()
     }
 #endif
 
+#if (COMPILER(RVCT) && defined(__TARGET_FPU_VFP)) || (COMPILER(GCC) && defined(__VFP_FP__))
+    return true;
+#else
     return false;
+#endif
 }
 
 const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.h b/JavaScriptCore/assembler/MacroAssemblerARM.h
index 5de8b34..49c87c0 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -400,8 +400,13 @@ public:
         if (right.m_isPointer) {
             m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
             m_assembler.cmp_r(left, ARMRegisters::S0);
-        } else
-            m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+        } else {
+            ARMWord tmp = m_assembler.getOp2(-right.m_value);
+            if (tmp != ARMAssembler::INVALID_IMM)
+                m_assembler.cmn_r(left, tmp);
+            else
+                m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+        }
         return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index f34c38c..87f0beb 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -1080,10 +1080,10 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
     // FIXME: Our hash tables won't hold infinity, so we make a new JSNumberCell each time.
     // Later we can do the extra work to handle that like the other cases.
     if (number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
-        return emitLoad(dst, jsNumber(globalData(), number));
+        return emitLoad(dst, jsNumber(number));
     JSValue& valueInMap = m_numberMap.add(number, JSValue()).first->second;
     if (!valueInMap)
-        valueInMap = jsNumber(globalData(), number);
+        valueInMap = jsNumber(number);
     return emitLoad(dst, valueInMap);
 }
 
diff --git a/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 449cae9..f282542 100644
--- a/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -208,7 +208,7 @@ RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     }
 
     if (m_elision) {
-        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
+        RegisterID* value = generator.emitLoad(0, jsNumber(m_elision + length));
         generator.emitPutById(array.get(), generator.propertyNames().length, value);
     }
 
diff --git a/JavaScriptCore/debugger/Debugger.cpp b/JavaScriptCore/debugger/Debugger.cpp
index 17dfdf7..472a03a 100644
--- a/JavaScriptCore/debugger/Debugger.cpp
+++ b/JavaScriptCore/debugger/Debugger.cpp
@@ -106,7 +106,14 @@ JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSG
     if (error)
         return error;
 
-    return globalObject->globalData()->interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
+    JSGlobalData& globalData = globalObject->globalData();
+    JSValue result = globalData.interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain());
+    if (globalData.exception) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+    }
+    ASSERT(result);
+    return result;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index c98c7cc..a5897c5 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -93,7 +93,14 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     if (error)
         return error;
 
-    return m_callFrame->scopeChain()->globalData->interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain(), &exception);
+    JSGlobalData& globalData = m_callFrame->globalData();
+    JSValue result = globalData.interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain());
+    if (globalData.exception) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+    }
+    ASSERT(result);
+    return result;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/interpreter/CachedCall.h b/JavaScriptCore/interpreter/CachedCall.h
index eb48a03..dfbe658 100644
--- a/JavaScriptCore/interpreter/CachedCall.h
+++ b/JavaScriptCore/interpreter/CachedCall.h
@@ -34,21 +34,20 @@
 namespace JSC {
     class CachedCall : public Noncopyable {
     public:
-        CachedCall(CallFrame* callFrame, JSFunction* function, int argCount, JSValue* exception)
+        CachedCall(CallFrame* callFrame, JSFunction* function, int argCount)
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
-            , m_exception(exception)
             , m_globalObjectScope(callFrame, function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
-            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
-            m_valid = !*exception;
+            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node());
+            m_valid = !callFrame->hadException();
         }
         
         JSValue call()
         { 
             ASSERT(m_valid);
-            return m_interpreter->execute(m_closure, m_exception);
+            return m_interpreter->execute(m_closure);
         }
         void setThis(JSValue v) { m_closure.setArgument(0, v); }
         void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
@@ -69,7 +68,6 @@ namespace JSC {
     private:
         bool m_valid;
         Interpreter* m_interpreter;
-        JSValue* m_exception;
         DynamicGlobalObjectScope m_globalObjectScope;
         CallFrameClosure m_closure;
     };
diff --git a/JavaScriptCore/interpreter/CallFrame.h b/JavaScriptCore/interpreter/CallFrame.h
index bde9786..56709f3 100644
--- a/JavaScriptCore/interpreter/CallFrame.h
+++ b/JavaScriptCore/interpreter/CallFrame.h
@@ -63,9 +63,6 @@ namespace JSC  {
             return scopeChain()->globalThis;
         }
 
-        // FIXME: Elsewhere, we use JSGlobalData* rather than JSGlobalData&.
-        // We should make this more uniform and either use a reference everywhere
-        // or a pointer everywhere.
         JSGlobalData& globalData() const
         {
             ASSERT(scopeChain()->globalData);
@@ -79,7 +76,6 @@ namespace JSC  {
 
         void clearException() { globalData().exception = JSValue(); }
         JSValue exception() const { return globalData().exception; }
-        JSValue* exceptionSlot() { return &globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 632571d..68be9fa 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -283,7 +283,7 @@ NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vP
     bool isStrictPut = vPC[3].u.operand;
     Identifier ident = callFrame->codeBlock()->identifier(property);
     JSValue result = JSC::resolveBase(callFrame, ident, callFrame->scopeChain(), isStrictPut);
-    if (!result) {
+    if (result) {
         callFrame->r(dst) = result;
         ASSERT(callFrame->r(dst).jsValue());
     } else
@@ -383,7 +383,7 @@ static NEVER_INLINE bool isInvalidParamForInstanceOf(CallFrame* callFrame, CodeB
 }
 #endif
 
-NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValue& exceptionValue)
+NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset)
 {
     if (argc < 2)
         return jsUndefined();
@@ -407,13 +407,14 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     }
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
+    JSValue exceptionValue;
     RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
 
-    JSValue result = jsUndefined();
-    if (eval)
-        result = callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->r(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
+    ASSERT(!eval == exceptionValue);
+    if (UNLIKELY(!eval))
+        return throwError(callFrame, exceptionValue);
 
-    return result;
+    return callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->r(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain);
 }
 
 Interpreter::Interpreter()
@@ -421,7 +422,7 @@ Interpreter::Interpreter()
     , m_reentryDepth(0)
 {
 #if ENABLE(COMPUTED_GOTO_INTERPRETER)
-    privateExecute(InitializeAndReturn, 0, 0, 0);
+    privateExecute(InitializeAndReturn, 0, 0);
 
     for (int i = 0; i < numOpcodeIDs; ++i)
         m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
@@ -448,7 +449,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     printf("-----------------------------------------------------------------------------\n");
 
     CodeBlock* codeBlock = callFrame->codeBlock();
-    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject->globalData()->interpreter->registerFile();
+    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject->globalData().interpreter->registerFile();
     const Register* it;
     const Register* end;
     JSValue v;
@@ -676,8 +677,8 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     }
 
     // Shrink the JS stack, in case stack overflow made it huge.
-    Register* highWaterMark = callFrame->registers() + callFrame->codeBlock()->m_numCalleeRegisters;
-    for (CallFrame* callerFrame = callFrame->callerFrame()->removeHostCallFrameFlag(); callerFrame; callerFrame = callerFrame->callerFrame()->removeHostCallFrameFlag()) {
+    Register* highWaterMark = 0;
+    for (CallFrame* callerFrame = callFrame; callerFrame; callerFrame = callerFrame->callerFrame()->removeHostCallFrameFlag()) {
         CodeBlock* codeBlock = callerFrame->codeBlock();
         if (!codeBlock)
             continue;
@@ -701,30 +702,34 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     return handler;
 }
 
-JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
+static inline JSValue checkedReturn(JSValue returnValue)
+{
+    ASSERT(returnValue);
+    return returnValue;
+}
+
+static inline JSObject* checkedReturn(JSObject* returnValue)
+{
+    ASSERT(returnValue);
+    return returnValue;
+}
+
+JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxSmallThreadReentryDepth) {
-        if (m_reentryDepth >= callFrame->globalData().maxReentryDepth) {
-            *exception = createStackOverflowError(callFrame);
-            return jsNull();
-        }
-    }
+    if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     JSObject* error = program->compile(callFrame, scopeChain);
-    if (error) {
-        *exception = error;
-        return jsNull();
-    }
+    if (error)
+        return checkedReturn(throwError(callFrame, error));
     CodeBlock* codeBlock = &program->generatedBytecode();
 
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize + codeBlock->m_numCalleeRegisters;
-    if (!m_registerFile.grow(newEnd)) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
-    }
+    if (!m_registerFile.grow(newEnd))
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     JSGlobalObject* lastGlobalObject = m_registerFile.globalObject();
     JSGlobalObject* globalObject = callFrame->dynamicGlobalObject();
@@ -751,10 +756,10 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
         m_reentryDepth++;  
 #if ENABLE(JIT)
         if (callFrame->globalData().canUseJIT())
-            result = program->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+            result = program->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
         else
 #endif
-            result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
+            result = privateExecute(Normal, &m_registerFile, newCallFrame);
 
         m_reentryDepth--;
     }
@@ -767,28 +772,22 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
 
     m_registerFile.shrink(oldEnd);
 
-    return result;
+    return checkedReturn(result);
 }
 
-JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, JSValue* exception)
+JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     ASSERT(!callFrame->hadException());
 
-    if (m_reentryDepth >= MaxSmallThreadReentryDepth) {
-        if (m_reentryDepth >= callFrame->globalData().maxReentryDepth) {
-            *exception = createStackOverflowError(callFrame);
-            return jsNull();
-        }
-    }
+    if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     Register* oldEnd = m_registerFile.end();
     int argCount = 1 + args.size(); // implicit "this" parameter
     size_t registerOffset = argCount + RegisterFile::CallFrameHeaderSize;
 
-    if (!m_registerFile.grow(oldEnd + registerOffset)) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
-    }
+    if (!m_registerFile.grow(oldEnd + registerOffset))
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -802,17 +801,15 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
 
         JSObject* compileError = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
         if (UNLIKELY(!!compileError)) {
-            *exception = compileError;
             m_registerFile.shrink(oldEnd);
-            return jsNull();
+            return checkedReturn(throwError(callFrame, compileError));
         }
 
         CodeBlock* newCodeBlock = &callData.js.functionExecutable->generatedBytecodeForCall();
         newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
         if (UNLIKELY(!newCallFrame)) {
-            *exception = createStackOverflowError(callFrame);
             m_registerFile.shrink(oldEnd);
-            return jsNull();
+            return checkedReturn(throwStackOverflowError(callFrame));
         }
 
         newCallFrame->init(newCodeBlock, 0, callDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
@@ -830,10 +827,10 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
             m_reentryDepth++;  
 #if ENABLE(JIT)
             if (callFrame->globalData().canUseJIT())
-                result = callData.js.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, newCallFrame, callDataScopeChain->globalData, exception);
+                result = callData.js.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, newCallFrame, callDataScopeChain->globalData);
             else
 #endif
-                result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
+                result = privateExecute(Normal, &m_registerFile, newCallFrame);
             m_reentryDepth--;
         }
 
@@ -841,7 +838,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
             (*profiler)->didExecute(newCallFrame, function);
 
         m_registerFile.shrink(oldEnd);
-        return result;
+        return checkedReturn(result);
     }
 
     ASSERT(callType == CallTypeHost);
@@ -865,28 +862,22 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
         (*profiler)->didExecute(newCallFrame, function);
 
     m_registerFile.shrink(oldEnd);
-    return result;
+    return checkedReturn(result);
 }
 
-JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* constructor, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue* exception)
+JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* constructor, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     ASSERT(!callFrame->hadException());
 
-    if (m_reentryDepth >= MaxSmallThreadReentryDepth) {
-        if (m_reentryDepth >= callFrame->globalData().maxReentryDepth) {
-            *exception = createStackOverflowError(callFrame);
-            return 0;
-        }
-    }
+    if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     Register* oldEnd = m_registerFile.end();
     int argCount = 1 + args.size(); // implicit "this" parameter
     size_t registerOffset = argCount + RegisterFile::CallFrameHeaderSize;
 
-    if (!m_registerFile.grow(oldEnd + registerOffset)) {
-        *exception = createStackOverflowError(callFrame);
-        return 0;
-    }
+    if (!m_registerFile.grow(oldEnd + registerOffset))
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -899,17 +890,15 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
 
         JSObject* compileError = constructData.js.functionExecutable->compileForConstruct(callFrame, constructDataScopeChain);
         if (UNLIKELY(!!compileError)) {
-            *exception = compileError;
             m_registerFile.shrink(oldEnd);
-            return 0;
+            return checkedReturn(throwError(callFrame, compileError));
         }
 
         CodeBlock* newCodeBlock = &constructData.js.functionExecutable->generatedBytecodeForConstruct();
         newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
         if (UNLIKELY(!newCallFrame)) {
-            *exception = createStackOverflowError(callFrame);
             m_registerFile.shrink(oldEnd);
-            return 0;
+            return checkedReturn(throwStackOverflowError(callFrame));
         }
 
         newCallFrame->init(newCodeBlock, 0, constructDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
@@ -927,10 +916,10 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
             m_reentryDepth++;  
 #if ENABLE(JIT)
             if (callFrame->globalData().canUseJIT())
-                result = constructData.js.functionExecutable->generatedJITCodeForConstruct().execute(&m_registerFile, newCallFrame, constructDataScopeChain->globalData, exception);
+                result = constructData.js.functionExecutable->generatedJITCodeForConstruct().execute(&m_registerFile, newCallFrame, constructDataScopeChain->globalData);
             else
 #endif
-                result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
+                result = privateExecute(Normal, &m_registerFile, newCallFrame);
             m_reentryDepth--;
         }
 
@@ -941,7 +930,7 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
         if (callFrame->hadException())
             return 0;
         ASSERT(result.isObject());
-        return asObject(result);
+        return checkedReturn(asObject(result));
     }
 
     ASSERT(constructType == ConstructTypeHost);
@@ -968,16 +957,16 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     if (callFrame->hadException())
         return 0;
     ASSERT(result.isObject());
-    return asObject(result);
+    return checkedReturn(asObject(result));
 }
 
-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionExecutable, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionExecutable, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain)
 {
     ASSERT(!scopeChain->globalData->exception);
     
     if (m_reentryDepth >= MaxSmallThreadReentryDepth) {
         if (m_reentryDepth >= callFrame->globalData().maxReentryDepth) {
-            *exception = createStackOverflowError(callFrame);
+            throwStackOverflowError(callFrame);
             return CallFrameClosure();
         }
     }
@@ -986,7 +975,7 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionE
     int argc = 1 + argCount; // implicit "this" parameter
     
     if (!m_registerFile.grow(oldEnd + argc)) {
-        *exception = createStackOverflowError(callFrame);
+        throwStackOverflowError(callFrame);
         return CallFrameClosure();
     }
 
@@ -997,7 +986,7 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionE
     
     JSObject* error = FunctionExecutable->compileForCall(callFrame, scopeChain);
     if (error) {
-        *exception = error;
+        throwError(callFrame, error);
         m_registerFile.shrink(oldEnd);
         return CallFrameClosure();
     }
@@ -1005,17 +994,16 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionE
 
     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     if (UNLIKELY(!newCallFrame)) {
-        *exception = createStackOverflowError(callFrame);
+        throwStackOverflowError(callFrame);
         m_registerFile.shrink(oldEnd);
         return CallFrameClosure();
     }
-    // a 0 codeBlock indicates a built-in caller
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), argc, function);  
     CallFrameClosure result = { callFrame, newCallFrame, function, FunctionExecutable, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
     return result;
 }
 
-JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception) 
+JSValue Interpreter::execute(CallFrameClosure& closure) 
 {
     closure.resetCallFrame();
     Profiler** profiler = Profiler::enabledProfilerReference();
@@ -1031,20 +1019,20 @@ JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception)
 #if ENABLE(INTERPRETER)
         if (closure.newCallFrame->globalData().canUseJIT())
 #endif
-            result = closure.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+            result = closure.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, closure.newCallFrame, closure.globalData);
 #if ENABLE(INTERPRETER)
         else
 #endif
 #endif
 #if ENABLE(INTERPRETER)
-            result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
+            result = privateExecute(Normal, &m_registerFile, closure.newCallFrame);
 #endif
         m_reentryDepth--;
     }
     
     if (*profiler)
         (*profiler)->didExecute(closure.oldCallFrame, closure.function);
-    return result;
+    return checkedReturn(result);
 }
 
 void Interpreter::endRepeatCall(CallFrameClosure& closure)
@@ -1052,34 +1040,26 @@ void Interpreter::endRepeatCall(CallFrameClosure& closure)
     m_registerFile.shrink(closure.oldEnd);
 }
 
-JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain)
 {
     JSObject* compileError = eval->compile(callFrame, scopeChain);
-    if (UNLIKELY(!!compileError)) {
-        *exception = compileError;
-        return jsNull();
-    }
-    return execute(eval, callFrame, thisObj, m_registerFile.size() + eval->generatedBytecode().m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
+    if (UNLIKELY(!!compileError))
+        return checkedReturn(throwError(callFrame, compileError));
+    return execute(eval, callFrame, thisObj, m_registerFile.size() + eval->generatedBytecode().m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain);
 }
 
-JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxSmallThreadReentryDepth) {
-        if (m_reentryDepth >= callFrame->globalData().maxReentryDepth) {
-            *exception = createStackOverflowError(callFrame);
-            return jsNull();
-        }
-    }
+    if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
+        return checkedReturn(throwStackOverflowError(callFrame));
 
     DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     JSObject* compileError = eval->compile(callFrame, scopeChain);
-    if (UNLIKELY(!!compileError)) {
-        *exception = compileError;
-        return jsNull();
-    }
+    if (UNLIKELY(!!compileError))
+        return checkedReturn(throwError(callFrame, compileError));
     EvalCodeBlock* codeBlock = &eval->generatedBytecode();
 
     JSObject* variableObject;
@@ -1121,15 +1101,13 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = m_registerFile.start() + globalRegisterOffset + codeBlock->m_numCalleeRegisters;
     if (!m_registerFile.grow(newEnd)) {
-        *exception = createStackOverflowError(callFrame);
         if (pushedScope)
             scopeChain->pop();
-        return jsNull();
+        return checkedReturn(throwStackOverflowError(callFrame));
     }
 
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
 
-    // a 0 codeBlock indicates a built-in caller
     ASSERT(codeBlock->m_numParameters == 1); // 1 parameter for 'this'.
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), codeBlock->m_numParameters, 0);
     newCallFrame->r(newCallFrame->hostThisRegister()) = JSValue(thisObj);
@@ -1151,13 +1129,13 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
 #if ENABLE(INTERPRETER)
         if (callFrame->globalData().canUseJIT())
 #endif
-            result = eval->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+            result = eval->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
 #if ENABLE(INTERPRETER)
         else
 #endif
 #endif
 #if ENABLE(INTERPRETER)
-            result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
+            result = privateExecute(Normal, &m_registerFile, newCallFrame);
 #endif
         m_reentryDepth--;
     }
@@ -1168,7 +1146,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     m_registerFile.shrink(oldEnd);
     if (pushedScope)
         scopeChain->pop();
-    return result;
+    return checkedReturn(result);
 }
 
 NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHookID, int firstLine, int lastLine)
@@ -1227,7 +1205,7 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         return;
     }
     
-    JSCell* baseCell = asCell(baseValue);
+    JSCell* baseCell = baseValue.asCell();
     Structure* structure = baseCell->structure();
 
     if (structure->isUncacheableDictionary()) {
@@ -1317,7 +1295,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    Structure* structure = asCell(baseValue)->structure();
+    Structure* structure = baseValue.asCell()->structure();
 
     if (structure->isUncacheableDictionary()) {
         vPC[0] = getOpcode(op_get_by_id_generic);
@@ -1437,7 +1415,7 @@ NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock* codeBlock, Instruction*
 
 #endif // ENABLE(INTERPRETER)
 
-JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValue* exception)
+JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame)
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
@@ -1445,7 +1423,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         #if ENABLE(COMPUTED_GOTO_INTERPRETER)
             #define LIST_OPCODE_LABEL(id, length) &&id,
                 static Opcode labels[] = { FOR_EACH_OPCODE_ID(LIST_OPCODE_LABEL) };
-                for (size_t i = 0; i < sizeof(labels) / sizeof(Opcode); ++i)
+                for (size_t i = 0; i < WTF_ARRAY_LENGTH(labels); ++i)
                     m_opcodeTable[i] = labels[i];
             #undef LIST_OPCODE_LABEL
         #endif // ENABLE(COMPUTED_GOTO_INTERPRETER)
@@ -1463,7 +1441,6 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if !ENABLE(INTERPRETER)
     UNUSED_PARAM(registerFile);
     UNUSED_PARAM(callFrame);
-    UNUSED_PARAM(exception);
     return JSValue();
 #else
 
@@ -1656,7 +1633,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        callFrame->r(dst) = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
+        callFrame->r(dst) = jsBoolean(!src.isCell() || !src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
         vPC += OPCODE_LENGTH(op_neq_null);
         NEXT_INSTRUCTION();
     }
@@ -1737,9 +1714,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX)
-            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
+            callFrame->r(srcDst) = jsNumber(v.asInt32() + 1);
         else {
-            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
+            JSValue result = jsNumber(v.toNumber(callFrame) + 1);
             CHECK_FOR_EXCEPTION();
             callFrame->r(srcDst) = result;
         }
@@ -1756,9 +1733,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN)
-            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
+            callFrame->r(srcDst) = jsNumber(v.asInt32() - 1);
         else {
-            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
+            JSValue result = jsNumber(v.toNumber(callFrame) - 1);
             CHECK_FOR_EXCEPTION();
             callFrame->r(srcDst) = result;
         }
@@ -1777,12 +1754,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX) {
-            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
+            callFrame->r(srcDst) = jsNumber(v.asInt32() + 1);
             callFrame->r(dst) = v;
         } else {
             JSValue number = callFrame->r(srcDst).jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
-            callFrame->r(srcDst) = jsNumber(callFrame, number.uncheckedGetNumber() + 1);
+            callFrame->r(srcDst) = jsNumber(number.uncheckedGetNumber() + 1);
             callFrame->r(dst) = number;
         }
 
@@ -1800,12 +1777,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN) {
-            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
+            callFrame->r(srcDst) = jsNumber(v.asInt32() - 1);
             callFrame->r(dst) = v;
         } else {
             JSValue number = callFrame->r(srcDst).jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
-            callFrame->r(srcDst) = jsNumber(callFrame, number.uncheckedGetNumber() - 1);
+            callFrame->r(srcDst) = jsNumber(number.uncheckedGetNumber() - 1);
             callFrame->r(dst) = number;
         }
 
@@ -1843,9 +1820,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32() && (src.asInt32() & 0x7fffffff)) // non-zero and no overflow
-            callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
+            callFrame->r(dst) = jsNumber(-src.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
+            JSValue result = jsNumber(-src.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -1864,7 +1841,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
-            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
+            callFrame->r(dst) = jsNumber(src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
             CHECK_FOR_EXCEPTION();
@@ -1883,9 +1860,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
-                callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() * src2.asInt32());
+                callFrame->r(dst) = jsNumber(src1.asInt32() * src2.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+            JSValue result = jsNumber(src1.toNumber(callFrame) * src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -1904,7 +1881,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
-        JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
+        JSValue result = jsNumber(dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
@@ -1923,7 +1900,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
-            JSValue result = jsNumber(callFrame, dividend.asInt32() % divisor.asInt32());
+            JSValue result = jsNumber(dividend.asInt32() % divisor.asInt32());
             ASSERT(result);
             callFrame->r(dst) = result;
             vPC += OPCODE_LENGTH(op_mod);
@@ -1934,7 +1911,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         // order of argument evaluation is not guaranteed.
         double d1 = dividend.toNumber(callFrame);
         double d2 = divisor.toNumber(callFrame);
-        JSValue result = jsNumber(callFrame, fmod(d1, d2));
+        JSValue result = jsNumber(fmod(d1, d2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
         vPC += OPCODE_LENGTH(op_mod);
@@ -1951,9 +1928,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
-            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
+            callFrame->r(dst) = jsNumber(src1.asInt32() - src2.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+            JSValue result = jsNumber(src1.toNumber(callFrame) - src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -1972,9 +1949,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() << (shift.asInt32() & 0x1f));
+            callFrame->r(dst) = jsNumber(val.asInt32() << (shift.asInt32() & 0x1f));
         else {
-            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber((val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -1994,9 +1971,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
+            callFrame->r(dst) = jsNumber(val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
-            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber((val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2015,9 +1992,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
         if (val.isUInt32() && shift.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
+            callFrame->r(dst) = jsNumber(val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
-            JSValue result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber((val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2036,9 +2013,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() & src2.asInt32());
+            callFrame->r(dst) = jsNumber(src1.asInt32() & src2.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+            JSValue result = jsNumber(src1.toInt32(callFrame) & src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2057,9 +2034,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() ^ src2.asInt32());
+            callFrame->r(dst) = jsNumber(src1.asInt32() ^ src2.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+            JSValue result = jsNumber(src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2078,9 +2055,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() | src2.asInt32());
+            callFrame->r(dst) = jsNumber(src1.asInt32() | src2.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+            JSValue result = jsNumber(src1.toInt32(callFrame) | src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2097,9 +2074,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32())
-            callFrame->r(dst) = jsNumber(callFrame, ~src.asInt32());
+            callFrame->r(dst) = jsNumber(~src.asInt32());
         else {
-            JSValue result = jsNumber(callFrame, ~src.toInt32(callFrame));
+            JSValue result = jsNumber(~src.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
@@ -2515,7 +2492,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
 
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2546,7 +2523,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
 
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2585,7 +2562,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2630,7 +2607,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2711,7 +2688,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
 
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2760,7 +2737,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2803,7 +2780,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2860,7 +2837,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2915,7 +2892,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
             
             if (LIKELY(baseCell->structure() == structure)) {
@@ -2965,7 +2942,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asArray(baseValue)->length());
+            callFrame->r(dst) = jsNumber(asArray(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_array_length);
             NEXT_INSTRUCTION();
         }
@@ -2985,7 +2962,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->length());
+            callFrame->r(dst) = jsNumber(asString(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
@@ -3041,7 +3018,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
         
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* oldStructure = vPC[4].u.structure;
             Structure* newStructure = vPC[5].u.structure;
             
@@ -3093,7 +3070,7 @@ skip_id_custom_self:
         JSValue baseValue = callFrame->r(base).jsValue();
 
         if (LIKELY(baseValue.isCell())) {
-            JSCell* baseCell = asCell(baseValue);
+            JSCell* baseCell = baseValue.asCell();
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
@@ -3203,7 +3180,7 @@ skip_id_custom_self:
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         } else
-            callFrame->r(dst) = jsNumber(callFrame, callFrame->argumentCount());
+            callFrame->r(dst) = jsNumber(callFrame->argumentCount());
 
         vPC += OPCODE_LENGTH(op_get_arguments_length);
         NEXT_INSTRUCTION();
@@ -3820,8 +3797,8 @@ skip_id_custom_self:
         JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-            JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-            if (exceptionValue)
+            JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset);
+            if ((exceptionValue = globalData->exception))
                 goto vm_throw;
             functionReturnValue = result;
 
@@ -4087,14 +4064,13 @@ skip_id_custom_self:
         if (activationValue) {
             asActivation(activationValue)->copyRegisters();
 
-            if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue())
-                asArguments(argumentsValue)->setActivation(asActivation(activationValue));
-        } else if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue())
-            asArguments(argumentsValue)->copyRegisters();
-
-        if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
+            if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
+                if (!codeBlock->isStrictMode())
+                    asArguments(argumentsValue)->setActivation(asActivation(activationValue));
+            }
+        } else if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
             if (!codeBlock->isStrictMode())
-                asArguments(argumentsValue)->setActivation(asActivation(activationValue));
+                asArguments(argumentsValue)->copyRegisters();
         }
 
         vPC += OPCODE_LENGTH(op_tear_off_activation);
@@ -4601,10 +4577,8 @@ skip_id_custom_self:
         exceptionValue = callFrame->r(ex).jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - codeBlock->instructions().begin(), true);
-        if (!handler) {
-            *exception = exceptionValue;
-            return jsNull();
-        }
+        if (!handler)
+            return throwError(callFrame, exceptionValue);
 
         codeBlock = callFrame->codeBlock();
         vPC = codeBlock->instructions().begin() + handler->target;
@@ -4771,10 +4745,8 @@ skip_id_custom_self:
             exceptionValue = createInterruptedExecutionException(globalData);
         }
         handler = throwException(callFrame, exceptionValue, vPC - codeBlock->instructions().begin(), false);
-        if (!handler) {
-            *exception = exceptionValue;
-            return jsNull();
-        }
+        if (!handler)
+            return throwError(callFrame, exceptionValue);
 
         codeBlock = callFrame->codeBlock();
         vPC = codeBlock->instructions().begin() + handler->target;
diff --git a/JavaScriptCore/interpreter/Interpreter.h b/JavaScriptCore/interpreter/Interpreter.h
index 50f07b3..2bc403e 100644
--- a/JavaScriptCore/interpreter/Interpreter.h
+++ b/JavaScriptCore/interpreter/Interpreter.h
@@ -93,11 +93,11 @@ namespace JSC {
         }
 
         bool isOpcode(Opcode);
-        
-        JSValue execute(ProgramExecutable*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
-        JSValue executeCall(CallFrame*, JSObject* function, CallType, const CallData&, JSValue thisValue, const ArgList&, JSValue* exception);
-        JSObject* executeConstruct(CallFrame*, JSObject* function, ConstructType, const ConstructData&, const ArgList&, JSValue* exception);
-        JSValue execute(EvalExecutable* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
+
+        JSValue execute(ProgramExecutable*, CallFrame*, ScopeChainNode*, JSObject* thisObj);
+        JSValue executeCall(CallFrame*, JSObject* function, CallType, const CallData&, JSValue thisValue, const ArgList&);
+        JSObject* executeConstruct(CallFrame*, JSObject* function, ConstructType, const ConstructData&, const ArgList&);
+        JSValue execute(EvalExecutable* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain);
 
         JSValue retrieveArguments(CallFrame*, JSFunction*) const;
         JSValue retrieveCaller(CallFrame*, JSFunction*) const;
@@ -107,7 +107,7 @@ namespace JSC {
         
         SamplingTool* sampler() { return m_sampler.get(); }
 
-        NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
+        NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset);
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
         NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
 
@@ -117,11 +117,11 @@ namespace JSC {
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*);
         void endRepeatCall(CallFrameClosure&);
-        JSValue execute(CallFrameClosure&, JSValue* exception);
+        JSValue execute(CallFrameClosure&);
 
-        JSValue execute(EvalExecutable*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalExecutable*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*);
 
 #if ENABLE(INTERPRETER)
         NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
@@ -144,7 +144,7 @@ namespace JSC {
 
         static CallFrame* findFunctionCallFrame(CallFrame*, JSFunction*);
 
-        JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValue* exception);
+        JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*);
 
         void dumpCallFrame(CallFrame*);
         void dumpRegisters(CallFrame*);
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index d4fa12f..f0a049a 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -888,7 +888,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
 
-    addSlowCase(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    addSlowCase(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNumber(0)))));
     m_assembler.cdq();
     m_assembler.idivl_r(regT2);
     emitFastArithReTagImmediate(regT1, regT0);
diff --git a/JavaScriptCore/jit/JITArithmetic32_64.cpp b/JavaScriptCore/jit/JITArithmetic32_64.cpp
index e53af77..e0b31f0 100644
--- a/JavaScriptCore/jit/JITArithmetic32_64.cpp
+++ b/JavaScriptCore/jit/JITArithmetic32_64.cpp
@@ -1293,7 +1293,7 @@ void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if CPU(X86) || CPU(X86_64)
+#if CPU(X86) || CPU(X86_64) || CPU(MIPS)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1301,34 +1301,47 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if CPU(X86) || CPU(X86_64)
+    // Make sure registers are correct for x86 IDIV instructions.
+    ASSERT(regT0 == X86Registers::eax);
+    ASSERT(regT1 == X86Registers::edx);
+    ASSERT(regT2 == X86Registers::ecx);
+    ASSERT(regT3 == X86Registers::ebx);
+#endif
+
     if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
-        emitLoad(op1, X86Registers::edx, X86Registers::eax);
-        move(Imm32(getConstantOperand(op2).asInt32()), X86Registers::ecx);
-        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
+        emitLoad(op1, regT1, regT0);
+        move(Imm32(getConstantOperand(op2).asInt32()), regT2);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         if (getConstantOperand(op2).asInt32() == -1)
-            addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+            addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
     } else {
-        emitLoad2(op1, X86Registers::edx, X86Registers::eax, op2, X86Registers::ebx, X86Registers::ecx);
-        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
-        addSlowCase(branch32(NotEqual, X86Registers::ebx, Imm32(JSValue::Int32Tag)));
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
 
-        addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
-        addSlowCase(branch32(Equal, X86Registers::ecx, Imm32(0))); // divide by 0
+        addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+        addSlowCase(branch32(Equal, regT2, Imm32(0))); // divide by 0
     }
 
-    move(X86Registers::eax, X86Registers::ebx); // Save dividend payload, in case of 0.
+    move(regT0, regT3); // Save dividend payload, in case of 0.
+#if CPU(X86) || CPU(X86_64)
     m_assembler.cdq();
-    m_assembler.idivl_r(X86Registers::ecx);
+    m_assembler.idivl_r(regT2);
+#elif CPU(MIPS)
+    m_assembler.div(regT0, regT2);
+    m_assembler.mfhi(regT1);
+#endif
 
     // If the remainder is zero and the dividend is negative, the result is -0.
-    Jump storeResult1 = branchTest32(NonZero, X86Registers::edx);
-    Jump storeResult2 = branchTest32(Zero, X86Registers::ebx, Imm32(0x80000000)); // not negative
-    emitStore(dst, jsNumber(m_globalData, -0.0));
+    Jump storeResult1 = branchTest32(NonZero, regT1);
+    Jump storeResult2 = branchTest32(Zero, regT3, Imm32(0x80000000)); // not negative
+    emitStore(dst, jsNumber(-0.0));
     Jump end = jump();
 
     storeResult1.link(this);
     storeResult2.link(this);
-    emitStoreInt32(dst, X86Registers::edx, (op1 == dst || op2 == dst));
+    emitStoreInt32(dst, regT1, (op1 == dst || op2 == dst));
     end.link(this);
 }
 
@@ -1355,7 +1368,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(dst);
 }
 
-#else // CPU(X86) || CPU(X86_64)
+#else // CPU(X86) || CPU(X86_64) || CPU(MIPS)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
diff --git a/JavaScriptCore/jit/JITCode.h b/JavaScriptCore/jit/JITCode.h
index 5d889b5..7346fd5 100644
--- a/JavaScriptCore/jit/JITCode.h
+++ b/JavaScriptCore/jit/JITCode.h
@@ -72,9 +72,10 @@ namespace JSC {
         }
 
         // Execute the code!
-        inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValue* exception)
+        inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData)
         {
-            return JSValue::decode(ctiTrampoline(m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+            JSValue result = JSValue::decode(ctiTrampoline(m_ref.m_code.executableAddress(), registerFile, callFrame, 0, Profiler::enabledProfilerReference(), globalData));
+            return globalData->exception ? jsNull() : result;
         }
 
         void* start()
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index 0fe9929..7611151 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -186,7 +186,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
-    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 }
 
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index a468c18..1528b76 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -198,6 +198,8 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     int executableOffsetToFunction = isConstruct ? OBJECT_OFFSETOF(NativeExecutable, m_constructor) : OBJECT_OFFSETOF(NativeExecutable, m_function);
 
     Label nativeCallThunk = align();
+    
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
 
 #if CPU(X86_64)
     // Load caller frame's scope chain into this callframe so that whatever we call can
@@ -711,7 +713,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
     addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
@@ -831,7 +833,7 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0))));
     addJump(emitJumpIfImmediateInteger(regT0), target);
 
     addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
@@ -1062,7 +1064,10 @@ void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 void JIT::emit_op_catch(Instruction* currentInstruction)
 {
     killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
-    peek(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    move(regT0, callFrameRegister);
+    peek(regT3, OBJECT_OFFSETOF(struct JITStackFrame, globalData) / sizeof(void*));
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)), regT0);
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)));
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -1284,7 +1289,7 @@ void JIT::emit_op_create_this(Instruction* currentInstruction)
 
 void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
 {
-    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof(void*));
     Jump noProfiler = branchTestPtr(Zero, Address(regT1));
 
     JITStubCall stubCall(this, cti_op_profile_will_call);
@@ -1296,7 +1301,7 @@ void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
 
 void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 {
-    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof(void*));
     Jump noProfiler = branchTestPtr(Zero, Address(regT1));
 
     JITStubCall stubCall(this, cti_op_profile_did_call);
diff --git a/JavaScriptCore/jit/JITOpcodes32_64.cpp b/JavaScriptCore/jit/JITOpcodes32_64.cpp
index c3b7ac2..0a3d69d 100644
--- a/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -198,6 +198,8 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     Label nativeCallThunk = align();
 
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
+
 #if CPU(X86)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
@@ -312,6 +314,8 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     Call nativeCall;
     Label nativeCallThunk = align();
 
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
+
 #if CPU(X86)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
@@ -923,11 +927,8 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    set32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
-    set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
-    or32(regT2, regT1);
-
-    addJump(branchTest32(NonZero, regT1), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
+    addJump(branch32(AboveOrEqual, regT1, Imm32(JSValue::UndefinedTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -950,11 +951,8 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    set32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
-    set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
-    or32(regT2, regT1);
-
-    addJump(branchTest32(Zero, regT1), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
+    addJump(branch32(Below, regT1, Imm32(JSValue::UndefinedTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -1388,15 +1386,17 @@ void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 
 void JIT::emit_op_catch(Instruction* currentInstruction)
 {
-    unsigned exception = currentInstruction[1].u.operand;
-
-    // This opcode only executes after a return from cti_op_throw.
-
-    // cti_op_throw may have taken us to a call frame further up the stack; reload
-    // the call frame pointer to adjust.
-    peek(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    // cti_op_throw returns the callFrame for the handler.
+    move(regT0, callFrameRegister);
 
     // Now store the exception returned by cti_op_throw.
+    loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(struct JITStackFrame, globalData)), regT3);
+    load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
+    load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
+    store32(Imm32(JSValue().payload()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    store32(Imm32(JSValue().tag()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+
+    unsigned exception = currentInstruction[1].u.operand;
     emitStore(exception, regT1, regT0);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_catch), exception, regT1, regT0);
 }
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 2edc860..1b95eec 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -585,10 +585,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(asCell(prototype)->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(prototype)->m_structure), regT3));
+    move(ImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(prototype)->m_structure), ImmPtr(asCell(prototype)->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
diff --git a/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index f6280ef..710a155 100644
--- a/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -595,10 +595,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(asCell(prototype)->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(prototype)->m_structure), regT3));
+    move(ImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(prototype)->m_structure), ImmPtr(asCell(prototype)->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index 8340211..c69a828 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -147,12 +147,7 @@ HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movl %esp, %ecx" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "addl $0x3c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
+    "int3" "\n"
 );
     
 asm (
@@ -209,14 +204,7 @@ HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "addq $0x48, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r15" "\n"
-    "popq %r14" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
+    "int3" "\n"
 );
 
 asm (
@@ -261,7 +249,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_
 
 extern "C" {
 
-    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*)
     {
         __asm {
             push ebp;
@@ -373,12 +361,7 @@ HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movl %esp, %ecx" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
+    "int3" "\n"
 );
     
 asm (
@@ -442,14 +425,7 @@ HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "addq $0x78, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r15" "\n"
-    "popq %r14" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
+    "int3" "\n"
 );
 
 asm (
@@ -508,7 +484,7 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_s
 
 extern "C" {
 
-    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*)
     {
         __asm {
             push ebp;
@@ -763,7 +739,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 
 #elif COMPILER(RVCT) && CPU(ARM_TRADITIONAL)
 
-__asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, JSValue*, Profiler**, JSGlobalData*)
+__asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*)
 {
     ARM
     stmdb sp!, {r1-r3}
@@ -872,7 +848,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
     
-    JSCell* baseCell = asCell(baseValue);
+    JSCell* baseCell = baseValue.asCell();
     Structure* structure = baseCell->structure();
 
     if (structure->isUncacheableDictionary()) {
@@ -940,7 +916,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
-    JSCell* baseCell = asCell(baseValue);
+    JSCell* baseCell = baseValue.asCell();
     Structure* structure = baseCell->structure();
 
     if (structure->isUncacheableDictionary()) {
@@ -1087,6 +1063,25 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
+struct ExceptionHandler {
+    void* catchRoutine;
+    CallFrame* callFrame;
+};
+static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame, JSValue exceptionValue, ReturnAddressPtr faultLocation, bool explicitThrow)
+{
+    ASSERT(exceptionValue);
+
+    unsigned vPCIndex = callFrame->codeBlock()->bytecodeOffset(callFrame, faultLocation);
+    globalData->exception = JSValue();
+    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, explicitThrow); // This may update callFrame & exceptionValue!
+    globalData->exception = exceptionValue;
+
+    void* catchRoutine = handler ? handler->nativeCode.executableAddress() : FunctionPtr(ctiOpThrowNotCaught).value();
+    ASSERT(catchRoutine);
+    ExceptionHandler exceptionHandler = { catchRoutine, callFrame };
+    return exceptionHandler;
+}
+
 #if CPU(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
@@ -1342,7 +1337,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 
     double left = 0.0, right;
     if (v1.getNumber(left) && v2.getNumber(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
+        return JSValue::encode(jsNumber(left + right));
 
     // All other cases are pretty uncommon
     JSValue result = jsAddSlowCase(callFrame, v1, v2);
@@ -1357,7 +1352,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_inc)
     JSValue v = stackFrame.args[0].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) + 1);
+    JSValue result = jsNumber(v.toNumber(callFrame) + 1);
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -1380,18 +1375,21 @@ DEFINE_STUB_FUNCTION(int, timeout_check)
     return timeoutChecker.ticksUntilNextCheck();
 }
 
-DEFINE_STUB_FUNCTION(void, register_file_check)
+DEFINE_STUB_FUNCTION(void*, register_file_check)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
 
-    if (LIKELY(stackFrame.registerFile->grow(&stackFrame.callFrame->registers()[stackFrame.callFrame->codeBlock()->m_numCalleeRegisters])))
-        return;
+    if (UNLIKELY(!stackFrame.registerFile->grow(&callFrame->registers()[callFrame->codeBlock()->m_numCalleeRegisters]))) {
+        // Rewind to the previous call frame because op_call already optimistically
+        // moved the call frame forward.
+        CallFrame* oldCallFrame = callFrame->callerFrame();
+        ExceptionHandler handler = jitThrow(stackFrame.globalData, oldCallFrame, createStackOverflowError(oldCallFrame), ReturnAddressPtr(oldCallFrame->returnPC()), false);
+        STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+        callFrame = handler.callFrame;
+    }
 
-    // Rewind to the previous call frame because op_call already optimistically
-    // moved the call frame forward.
-    CallFrame* oldCallFrame = stackFrame.callFrame->callerFrame();
-    stackFrame.callFrame = oldCallFrame;
-    throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
+    return callFrame;
 }
 
 DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
@@ -1563,7 +1561,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSObject* slotBaseObject;
     if (baseValue.isCell()
         && slot.isCacheableValue()
-        && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
+        && !(structure = baseValue.asCell()->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
         ) {
@@ -1637,7 +1635,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
     if (baseValue.isCell()
         && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isUncacheableDictionary()
+        && !baseValue.asCell()->structure()->isUncacheableDictionary()
         && slot.slotBase() == baseValue) {
 
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -1658,7 +1656,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         }
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             stubInfo->u.getByIdSelfList.listSize++;
-            JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
+            JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, baseValue.asCell()->structure(), ident, slot, slot.cachedOffset());
 
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
@@ -1742,12 +1740,12 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || baseValue.asCell()->structure()->isDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
 
-    Structure* structure = asCell(baseValue)->structure();
+    Structure* structure = baseValue.asCell()->structure();
     CodeBlock* codeBlock = callFrame->codeBlock();
     StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
 
@@ -1758,8 +1756,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
-    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
-        ASSERT(!asCell(baseValue)->structure()->isDictionary());
+    else if (slot.slotBase() == baseValue.asCell()->structure()->prototypeForLookup(callFrame)) {
+        ASSERT(!baseValue.asCell()->structure()->isDictionary());
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
@@ -1776,7 +1774,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
         }
     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
-        ASSERT(!asCell(baseValue)->structure()->isDictionary());
+        ASSERT(!baseValue.asCell()->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
         
@@ -1913,10 +1911,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_mul)
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left * right));
+        return JSValue::encode(jsNumber(left * right));
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+    JSValue result = jsNumber(src1.toNumber(callFrame) * src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -1994,9 +1992,9 @@ DEFINE_STUB_FUNCTION(void*, op_call_arityCheck)
         if (!stackFrame.registerFile->grow(newEnd)) {
             // Rewind to the previous call frame because op_call already optimistically
             // moved the call frame forward.
-            stackFrame.callFrame = oldCallFrame;
-            throwStackOverflowError(oldCallFrame, stackFrame.globalData, pc, STUB_RETURN_ADDRESS);
-            return 0;
+            ExceptionHandler handler = jitThrow(stackFrame.globalData, oldCallFrame, createStackOverflowError(oldCallFrame), pc, false);
+            STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+            return handler.callFrame;
         }
 
         Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
@@ -2009,9 +2007,9 @@ DEFINE_STUB_FUNCTION(void*, op_call_arityCheck)
         if (!stackFrame.registerFile->grow(newEnd)) {
             // Rewind to the previous call frame because op_call already optimistically
             // moved the call frame forward.
-            stackFrame.callFrame = oldCallFrame;
-            throwStackOverflowError(oldCallFrame, stackFrame.globalData, pc, STUB_RETURN_ADDRESS);
-            return 0;
+            ExceptionHandler handler = jitThrow(stackFrame.globalData, oldCallFrame, createStackOverflowError(oldCallFrame), pc, false);
+            STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+            return handler.callFrame;
         }
 
         Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
@@ -2053,9 +2051,9 @@ DEFINE_STUB_FUNCTION(void*, op_construct_arityCheck)
         if (!stackFrame.registerFile->grow(newEnd)) {
             // Rewind to the previous call frame because op_call already optimistically
             // moved the call frame forward.
-            stackFrame.callFrame = oldCallFrame;
-            throwStackOverflowError(oldCallFrame, stackFrame.globalData, pc, STUB_RETURN_ADDRESS);
-            return 0;
+            ExceptionHandler handler = jitThrow(stackFrame.globalData, oldCallFrame, createStackOverflowError(oldCallFrame), pc, false);
+            STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+            return handler.callFrame;
         }
 
         Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
@@ -2068,9 +2066,9 @@ DEFINE_STUB_FUNCTION(void*, op_construct_arityCheck)
         if (!stackFrame.registerFile->grow(newEnd)) {
             // Rewind to the previous call frame because op_call already optimistically
             // moved the call frame forward.
-            stackFrame.callFrame = oldCallFrame;
-            throwStackOverflowError(oldCallFrame, stackFrame.globalData, pc, STUB_RETURN_ADDRESS);
-            return 0;
+            ExceptionHandler handler = jitThrow(stackFrame.globalData, oldCallFrame, createStackOverflowError(oldCallFrame), pc, false);
+            STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+            return handler.callFrame;
         }
 
         Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
@@ -2188,17 +2186,16 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction)
             throwStackOverflowError(previousCallFrame, stackFrame.globalData, callFrame->returnPC(), STUB_RETURN_ADDRESS);
             VM_THROW_EXCEPTION();
         }
+
         callFrame->init(0, static_cast<Instruction*>((STUB_RETURN_ADDRESS).value()), previousCallFrame->scopeChain(), previousCallFrame, argCount, asObject(funcVal));
-        stackFrame.callFrame = callFrame;
 
         EncodedJSValue returnValue;
         {
             SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
             returnValue = callData.native.function(callFrame);
         }
-        stackFrame.callFrame = previousCallFrame;
-        CHECK_FOR_EXCEPTION();
 
+        CHECK_FOR_EXCEPTION_AT_END();
         return returnValue;
     }
 
@@ -2234,8 +2231,10 @@ DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
     ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
     JSValue activationValue = stackFrame.args[0].jsValue();
     if (!activationValue) {
-        if (JSValue v = stackFrame.args[1].jsValue())
-            asArguments(v)->copyRegisters();
+        if (JSValue v = stackFrame.args[1].jsValue()) {
+            if (!stackFrame.callFrame->codeBlock()->isStrictMode())
+                asArguments(v)->copyRegisters();
+        }
         return;
     }
     JSActivation* activation = asActivation(stackFrame.args[0].jsValue());
@@ -2336,16 +2335,14 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
         }
 
         callFrame->init(0, static_cast<Instruction*>((STUB_RETURN_ADDRESS).value()), previousCallFrame->scopeChain(), previousCallFrame, argCount, asObject(constrVal));
-        stackFrame.callFrame = callFrame;
 
         EncodedJSValue returnValue;
         {
             SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
             returnValue = constructData.native.function(callFrame);
         }
-        stackFrame.callFrame = previousCallFrame;
-        CHECK_FOR_EXCEPTION();
 
+        CHECK_FOR_EXCEPTION_AT_END();
         return returnValue;
     }
 
@@ -2370,10 +2367,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
 
     if (LIKELY(baseValue.isCell() && subscript.isString())) {
         Identifier propertyName(callFrame, asString(subscript)->value(callFrame));
-        PropertySlot slot(asCell(baseValue));
+        PropertySlot slot(baseValue.asCell());
         // JSString::value may have thrown, but we shouldn't find a property with a null identifier,
         // so we should miss this case and wind up in the CHECK_FOR_EXCEPTION_AT_END, below.
-        if (asCell(baseValue)->fastGetOwnPropertySlot(callFrame, propertyName, slot)) {
+        if (baseValue.asCell()->fastGetOwnPropertySlot(callFrame, propertyName, slot)) {
             JSValue result = slot.getValue(callFrame, propertyName);
             CHECK_FOR_EXCEPTION();
             return JSValue::encode(result);
@@ -2475,10 +2472,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_sub)
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left - right));
+        return JSValue::encode(jsNumber(left - right));
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+    JSValue result = jsNumber(src1.toNumber(callFrame) - src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2685,10 +2682,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_negate)
 
     double v;
     if (src.getNumber(v))
-        return JSValue::encode(jsNumber(stackFrame.globalData, -v));
+        return JSValue::encode(jsNumber(-v));
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, -src.toNumber(callFrame));
+    JSValue result = jsNumber(-src.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2808,10 +2805,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_div)
     double left;
     double right;
     if (src1.getNumber(left) && src2.getNumber(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left / right));
+        return JSValue::encode(jsNumber(left / right));
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
+    JSValue result = jsNumber(src1.toNumber(callFrame) / src2.toNumber(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2823,7 +2820,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_dec)
     JSValue v = stackFrame.args[0].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) - 1);
+    JSValue result = jsNumber(v.toNumber(callFrame) - 1);
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2891,7 +2888,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
     JSValue number = v.toJSNumber(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
 
-    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() + 1);
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(number.uncheckedGetNumber() + 1);
     return JSValue::encode(number);
 }
 
@@ -2906,14 +2903,14 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     start:
     if (src2.isUndefined()) {
         return src1.isNull() || 
-               (src1.isCell() && asCell(src1)->structure()->typeInfo().masqueradesAsUndefined()) ||
-               src1.isUndefined();
+               (src1.isCell() && src1.asCell()->structure()->typeInfo().masqueradesAsUndefined())
+               || src1.isUndefined();
     }
     
     if (src2.isNull()) {
         return src1.isUndefined() || 
-               (src1.isCell() && asCell(src1)->structure()->typeInfo().masqueradesAsUndefined()) ||
-               src1.isNull();
+               (src1.isCell() && src1.asCell()->structure()->typeInfo().masqueradesAsUndefined())
+               || src1.isNull();
     }
 
     if (src1.isInt32()) {
@@ -2949,12 +2946,12 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     }
     
     if (src1.isUndefined())
-        return src2.isCell() && asCell(src2)->structure()->typeInfo().masqueradesAsUndefined();
+        return src2.isCell() && src2.asCell()->structure()->typeInfo().masqueradesAsUndefined();
     
     if (src1.isNull())
-        return src2.isCell() && asCell(src2)->structure()->typeInfo().masqueradesAsUndefined();
+        return src2.isCell() && src2.asCell()->structure()->typeInfo().masqueradesAsUndefined();
 
-    JSCell* cell1 = asCell(src1);
+    JSCell* cell1 = src1.asCell();
 
     if (cell1->isString()) {
         if (src2.isInt32())
@@ -2969,7 +2966,7 @@ DEFINE_STUB_FUNCTION(int, op_eq)
         if (src2.isFalse())
             return jsToNumber(static_cast<JSString*>(cell1)->value(stackFrame.callFrame)) == 0.0;
 
-        JSCell* cell2 = asCell(src2);
+        JSCell* cell2 = src2.asCell();
         if (cell2->isString())
             return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
 
@@ -3019,7 +3016,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
     JSValue shift = stackFrame.args[1].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+    JSValue result = jsNumber((val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3033,7 +3030,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitand)
 
     ASSERT(!src1.isInt32() || !src2.isInt32());
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+    JSValue result = jsNumber(src1.toInt32(callFrame) & src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3046,7 +3043,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
     JSValue shift = stackFrame.args[1].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    JSValue result = jsNumber((val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
 
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
@@ -3060,7 +3057,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
 
     ASSERT(!src.isInt32());
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, ~src.toInt32(callFrame));
+    JSValue result = jsNumber(~src.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3134,7 +3131,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
 
     CallFrame* callFrame = stackFrame.callFrame;
     double d = dividendValue.toNumber(callFrame);
-    JSValue result = jsNumber(stackFrame.globalData, fmod(d, divisorValue.toNumber(callFrame)));
+    JSValue result = jsNumber(fmod(d, divisorValue.toNumber(callFrame)));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3160,7 +3157,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_dec)
     JSValue number = v.toJSNumber(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
 
-    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() - 1);
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(number.uncheckedGetNumber() - 1);
     return JSValue::encode(number);
 }
 
@@ -3172,7 +3169,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_urshift)
     JSValue shift = stackFrame.args[1].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    JSValue result = jsNumber((val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3186,7 +3183,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitxor)
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+    JSValue result = jsNumber(src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3207,7 +3204,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+    JSValue result = jsNumber(src1.toInt32(callFrame) | src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -3232,43 +3229,20 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
     JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
     if (baseValue == globalObject && funcVal == globalObject->evalFunction()) {
-        JSValue exceptionValue;
-        JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue)) {
-            stackFrame.globalData->exception = exceptionValue;
-            VM_THROW_EXCEPTION_AT_END();
-        }
+        JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset);
+        CHECK_FOR_EXCEPTION_AT_END();
         return JSValue::encode(result);
     }
 
     return JSValue::encode(JSValue());
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
+DEFINE_STUB_FUNCTION(void*, op_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    unsigned vPCIndex = codeBlock->bytecodeOffset(callFrame, STUB_RETURN_ADDRESS);
-
-    JSValue exceptionValue = stackFrame.args[0].jsValue();
-    ASSERT(exceptionValue);
-
-    HandlerInfo* handler = stackFrame.globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
-
-    if (!handler) {
-        *stackFrame.exception = exceptionValue;
-        STUB_SET_RETURN_ADDRESS(FunctionPtr(ctiOpThrowNotCaught).value());
-        return JSValue::encode(jsNull());
-    }
-
-    stackFrame.callFrame = callFrame;
-    void* catchRoutine = handler->nativeCode.executableAddress();
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValue::encode(exceptionValue);
+    ExceptionHandler handler = jitThrow(stackFrame.globalData, stackFrame.callFrame, stackFrame.args[0].jsValue(), STUB_RETURN_ADDRESS, true);
+    STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+    return handler.callFrame;
 }
 
 DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
@@ -3617,32 +3591,13 @@ DEFINE_STUB_FUNCTION(void, op_debug)
     stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
+DEFINE_STUB_FUNCTION(void*, vm_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
     JSGlobalData* globalData = stackFrame.globalData;
-
-    unsigned vPCIndex = codeBlock->bytecodeOffset(callFrame, globalData->exceptionLocation);
-
-    JSValue exceptionValue = globalData->exception;
-    ASSERT(exceptionValue);
-    globalData->exception = JSValue();
-
-    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
-
-    if (!handler) {
-        *stackFrame.exception = exceptionValue;
-        return JSValue::encode(jsNull());
-    }
-
-    stackFrame.callFrame = callFrame;
-    void* catchRoutine = handler->nativeCode.executableAddress();
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValue::encode(exceptionValue);
+    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception, globalData->exceptionLocation, false);
+    STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
+    return handler.callFrame;
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, to_object)
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index b91a074..c27ee52 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -97,7 +97,7 @@ namespace JSC {
         void* code;
         RegisterFile* registerFile;
         CallFrame* callFrame;
-        JSValue* exception;
+        void* unused1;
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
 
@@ -133,7 +133,7 @@ namespace JSC {
         void* code;
         RegisterFile* registerFile;
         CallFrame* callFrame;
-        JSValue* exception;
+        void* unused1;
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
         
@@ -161,7 +161,7 @@ namespace JSC {
         // These arguments passed in r1..r3 (r0 contained the entry code pointed, which is not preserved)
         RegisterFile* registerFile;
         CallFrame* callFrame;
-        JSValue* exception;
+        void* unused1;
 
         // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
@@ -189,7 +189,7 @@ namespace JSC {
 
         RegisterFile* registerFile;
         CallFrame* callFrame;
-        JSValue* exception;
+        void* unused1;
 
         // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
@@ -221,7 +221,7 @@ namespace JSC {
         // These arguments passed in a1..a3 (a0 contained the entry code pointed, which is not preserved)
         RegisterFile* registerFile;
         CallFrame* callFrame;
-        JSValue* exception;
+        void* unused1;
 
         // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
@@ -252,7 +252,7 @@ namespace JSC {
 
     extern "C" void ctiVMThrowTrampoline();
     extern "C" void ctiOpThrowNotCaught();
-    extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
+    extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*);
 
     class JITThunks {
     public:
@@ -348,13 +348,11 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_strcat(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_stricteq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_sub(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_throw(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_to_jsnumber(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_to_primitive(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_to_object(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
@@ -395,7 +393,6 @@ extern "C" {
     void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_op_construct_arityCheck(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_op_call_jitCompile(STUB_ARGS_DECLARATION);
@@ -403,8 +400,11 @@ extern "C" {
     void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_throw(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
     void* JIT_STUB cti_vm_lazyLinkConstruct(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
 } // extern "C"
 
 } // namespace JSC
diff --git a/JavaScriptCore/jsc.cpp b/JavaScriptCore/jsc.cpp
index d756a0c..16647ec 100644
--- a/JavaScriptCore/jsc.cpp
+++ b/JavaScriptCore/jsc.cpp
@@ -220,7 +220,7 @@ EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
     evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
     stopWatch.stop();
 
-    return JSValue::encode(jsNumber(globalObject->globalExec(), stopWatch.getElapsedMS()));
+    return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
@@ -368,7 +368,7 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
     if (dump)
         BytecodeGenerator::setDumpsGeneratedCode(true);
 
-    JSGlobalData* globalData = globalObject->globalData();
+    JSGlobalData& globalData = globalObject->globalData();
 
 #if ENABLE(SAMPLING_FLAGS)
     SamplingFlags::start();
@@ -386,7 +386,7 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
             fileName = "[Command Line]";
         }
 
-        globalData->startSampling();
+        globalData.startSampling();
 
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script, fileName));
         success = success && completion.complType() != Throw;
@@ -397,19 +397,19 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
                 printf("End: %s\n", completion.value().toString(globalObject->globalExec()).utf8().data());
         }
 
-        globalData->stopSampling();
+        globalData.stopSampling();
         globalObject->globalExec()->clearException();
     }
 
 #if ENABLE(SAMPLING_FLAGS)
     SamplingFlags::stop();
 #endif
-    globalData->dumpSampleData(globalObject->globalExec());
+    globalData.dumpSampleData(globalObject->globalExec());
 #if ENABLE(SAMPLING_COUNTERS)
     AbstractSamplingCounter::dump();
 #endif
 #if ENABLE(REGEXP_TRACING)
-    globalData->dumpRegExpTrace();
+    globalData.dumpRegExpTrace();
 #endif
     return success;
 }
diff --git a/JavaScriptCore/parser/JSParser.cpp b/JavaScriptCore/parser/JSParser.cpp
index 0338210..4b7fcb2 100644
--- a/JavaScriptCore/parser/JSParser.cpp
+++ b/JavaScriptCore/parser/JSParser.cpp
@@ -485,7 +485,7 @@ private:
 
 int jsParse(JSGlobalObject* lexicalGlobalObject, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode parserMode, const SourceCode* source)
 {
-    JSParser parser(lexicalGlobalObject->globalData()->lexer, lexicalGlobalObject->globalData(), parameters, strictness == JSParseStrict, parserMode == JSParseFunctionCode, source->provider());
+    JSParser parser(lexicalGlobalObject->globalData().lexer, &lexicalGlobalObject->globalData(), parameters, strictness == JSParseStrict, parserMode == JSParseFunctionCode, source->provider());
     return parser.parseProgram(lexicalGlobalObject);
 }
 
diff --git a/JavaScriptCore/parser/Parser.cpp b/JavaScriptCore/parser/Parser.cpp
index 33b5213..49ce848 100644
--- a/JavaScriptCore/parser/Parser.cpp
+++ b/JavaScriptCore/parser/Parser.cpp
@@ -52,7 +52,7 @@ void Parser::parse(JSGlobalObject* lexicalGlobalObject, FunctionParameters* para
     *errLine = -1;
     *errMsg = UString();
 
-    Lexer& lexer = *lexicalGlobalObject->globalData()->lexer;
+    Lexer& lexer = *lexicalGlobalObject->globalData().lexer;
     lexer.setCode(*m_source, m_arena);
 
     int parseError = jsParse(lexicalGlobalObject, parameters, strictness, mode, m_source);
diff --git a/JavaScriptCore/parser/Parser.h b/JavaScriptCore/parser/Parser.h
index f5bbcb8..6549067 100644
--- a/JavaScriptCore/parser/Parser.h
+++ b/JavaScriptCore/parser/Parser.h
@@ -84,12 +84,12 @@ namespace JSC {
 
         m_source = &source;
         if (ParsedNode::scopeIsFunction)
-            lexicalGlobalObject->globalData()->lexer->setIsReparsing();
+            lexicalGlobalObject->globalData().lexer->setIsReparsing();
         parse(lexicalGlobalObject, parameters, strictness, ParsedNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, &errLine, &errMsg);
 
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
-            result = ParsedNode::create(lexicalGlobalObject->globalData(),
+            result = ParsedNode::create(&lexicalGlobalObject->globalData(),
                 m_sourceElements,
                 m_varDeclarations ? &m_varDeclarations->data : 0,
                 m_funcDeclarations ? &m_funcDeclarations->data : 0,
@@ -108,7 +108,7 @@ namespace JSC {
             if (isFunctionBodyNode(static_cast<ParsedNode*>(0)))
                 *exception = createStackOverflowError(lexicalGlobalObject);
             else
-                *exception = addErrorInfo(lexicalGlobalObject->globalData(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, source);
+                *exception = addErrorInfo(&lexicalGlobalObject->globalData(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, source);
         }
 
         m_arena.reset();
diff --git a/JavaScriptCore/runtime/Arguments.cpp b/JavaScriptCore/runtime/Arguments.cpp
index 5c5e522..39886a8 100644
--- a/JavaScriptCore/runtime/Arguments.cpp
+++ b/JavaScriptCore/runtime/Arguments.cpp
@@ -191,7 +191,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     }
 
     if (propertyName == exec->propertyNames().length && LIKELY(!d->overrodeLength)) {
-        slot.setValue(jsNumber(exec, d->numArguments));
+        slot.setValue(jsNumber(d->numArguments));
         return true;
     }
 
@@ -222,7 +222,7 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     }
     
     if (propertyName == exec->propertyNames().length && LIKELY(!d->overrodeLength)) {
-        descriptor.setDescriptor(jsNumber(exec, d->numArguments), DontEnum);
+        descriptor.setDescriptor(jsNumber(d->numArguments), DontEnum);
         return true;
     }
     
diff --git a/JavaScriptCore/runtime/ArrayConstructor.cpp b/JavaScriptCore/runtime/ArrayConstructor.cpp
index e5d0dac..632d466 100644
--- a/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -45,7 +45,7 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject
     putDirectWithoutTransition(exec->propertyNames().prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 
     // ES5
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 6002ebb..ab0c3d4 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -379,12 +379,12 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
     JSValue result;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
-        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
+        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, length - 1);
         thisObj->deleteProperty(exec, length - 1);
-        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - 1));
+        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - 1));
     }
     return JSValue::encode(result);
 }
@@ -395,7 +395,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
     if (isJSArray(&exec->globalData(), thisValue) && exec->argumentCount() == 1) {
         JSArray* array = asArray(thisValue);
         array->push(exec, exec->argument(0));
-        return JSValue::encode(jsNumber(exec, array->length()));
+        return JSValue::encode(jsNumber(array->length()));
     }
 
     JSObject* thisObj = thisValue.toThisObject(exec);
@@ -403,8 +403,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
     for (unsigned n = 0; n < exec->argumentCount(); n++)
         thisObj->put(exec, length + n, exec->argument(n));
     length += exec->argumentCount();
-    putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
-    return JSValue::encode(jsNumber(exec, length));
+    putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
+    return JSValue::encode(jsNumber(length));
 }
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
@@ -438,7 +438,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
-        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
+        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, 0);
@@ -453,7 +453,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
             }
             thisObj->deleteProperty(exec, length - 1);
         }
-        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - 1));
+        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - 1));
     }
     return JSValue::encode(result);
 }
@@ -600,7 +600,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
     for (unsigned k = 0; k < additionalArgs; ++k)
         thisObj->put(exec, k + begin, exec->argument(k + 2));
 
-    putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - deleteCount + additionalArgs));
+    putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - deleteCount + additionalArgs));
     return JSValue::encode(result);
 }
 
@@ -625,7 +625,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
     }
     for (unsigned k = 0; k < nrArgs; ++k)
         thisObj->put(exec, k, exec->argument(k));
-    JSValue result = jsNumber(exec, length + nrArgs);
+    JSValue result = jsNumber(length + nrArgs);
     putProperty(exec, thisObj, exec->propertyNames().length, result);
     return JSValue::encode(result);
 }
@@ -649,14 +649,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
         JSArray* array = asArray(thisObj);
-        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        CachedCall cachedCall(exec, f, 3);
         for (; k < length && !exec->hadException(); ++k) {
             if (!array->canGetIndex(k))
                 break;
             JSValue v = array->getIndex(k);
             cachedCall.setThis(applyThis);
             cachedCall.setArgument(0, v);
-            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
             
             JSValue result = cachedCall.call();
@@ -677,7 +677,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
         MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
-        eachArguments.append(jsNumber(exec, k));
+        eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
@@ -707,14 +707,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
         JSArray* array = asArray(thisObj);
-        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        CachedCall cachedCall(exec, f, 3);
         for (; k < length && !exec->hadException(); ++k) {
             if (UNLIKELY(!array->canGetIndex(k)))
                 break;
 
             cachedCall.setThis(applyThis);
             cachedCall.setArgument(0, array->getIndex(k));
-            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
 
             resultArray->JSArray::put(exec, k, cachedCall.call());
@@ -730,7 +730,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
         MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
-        eachArguments.append(jsNumber(exec, k));
+        eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
@@ -764,14 +764,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
         JSArray* array = asArray(thisObj);
-        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        CachedCall cachedCall(exec, f, 3);
         for (; k < length && !exec->hadException(); ++k) {
             if (UNLIKELY(!array->canGetIndex(k)))
                 break;
             
             cachedCall.setThis(applyThis);
             cachedCall.setArgument(0, array->getIndex(k));
-            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
             JSValue result = cachedCall.call();
             if (!result.toBoolean(cachedCall.newCallFrame(exec)))
@@ -787,7 +787,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
         MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(slot.getValue(exec, k));
-        eachArguments.append(jsNumber(exec, k));
+        eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
@@ -818,14 +818,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
         JSArray* array = asArray(thisObj);
-        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        CachedCall cachedCall(exec, f, 3);
         for (; k < length && !exec->hadException(); ++k) {
             if (UNLIKELY(!array->canGetIndex(k)))
                 break;
 
             cachedCall.setThis(applyThis);
             cachedCall.setArgument(0, array->getIndex(k));
-            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
 
             cachedCall.call();
@@ -838,7 +838,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 
         MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
-        eachArguments.append(jsNumber(exec, k));
+        eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         call(exec, function, callType, callData, applyThis, eachArguments);
@@ -865,14 +865,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
         JSArray* array = asArray(thisObj);
-        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        CachedCall cachedCall(exec, f, 3);
         for (; k < length && !exec->hadException(); ++k) {
             if (UNLIKELY(!array->canGetIndex(k)))
                 break;
             
             cachedCall.setThis(applyThis);
             cachedCall.setArgument(0, array->getIndex(k));
-            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(1, jsNumber(k));
             cachedCall.setArgument(2, thisObj);
             JSValue result = cachedCall.call();
             if (result.toBoolean(cachedCall.newCallFrame(exec)))
@@ -886,7 +886,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 
         MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
-        eachArguments.append(jsNumber(exec, k));
+        eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
@@ -935,7 +935,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
     }
 
     if (callType == CallTypeJS && array) {
-        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        CachedCall cachedCall(exec, asFunction(function), 4);
         for (; i < length && !exec->hadException(); ++i) {
             cachedCall.setThis(jsNull());
             cachedCall.setArgument(0, rv);
@@ -945,7 +945,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
             else
                 break; // length has been made unsafe while we enumerate fallback to slow path
             cachedCall.setArgument(1, v);
-            cachedCall.setArgument(2, jsNumber(exec, i));
+            cachedCall.setArgument(2, jsNumber(i));
             cachedCall.setArgument(3, array);
             rv = cachedCall.call();
         }
@@ -961,7 +961,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
         MarkedArgumentBuffer eachArguments;
         eachArguments.append(rv);
         eachArguments.append(prop);
-        eachArguments.append(jsNumber(exec, i));
+        eachArguments.append(jsNumber(i));
         eachArguments.append(thisObj);
         
         rv = call(exec, function, callType, callData, jsNull(), eachArguments);
@@ -1005,7 +1005,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
     }
     
     if (callType == CallTypeJS && array) {
-        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        CachedCall cachedCall(exec, asFunction(function), 4);
         for (; i < length && !exec->hadException(); ++i) {
             unsigned idx = length - i - 1;
             cachedCall.setThis(jsNull());
@@ -1013,7 +1013,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
             if (UNLIKELY(!array->canGetIndex(idx)))
                 break; // length has been made unsafe while we enumerate fallback to slow path
             cachedCall.setArgument(1, array->getIndex(idx));
-            cachedCall.setArgument(2, jsNumber(exec, idx));
+            cachedCall.setArgument(2, jsNumber(idx));
             cachedCall.setArgument(3, array);
             rv = cachedCall.call();
         }
@@ -1030,7 +1030,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
         MarkedArgumentBuffer eachArguments;
         eachArguments.append(rv);
         eachArguments.append(prop);
-        eachArguments.append(jsNumber(exec, idx));
+        eachArguments.append(jsNumber(idx));
         eachArguments.append(thisObj);
         
         rv = call(exec, function, callType, callData, jsNull(), eachArguments);
@@ -1053,10 +1053,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
         if (!e)
             continue;
         if (JSValue::strictEqual(exec, searchElement, e))
-            return JSValue::encode(jsNumber(exec, index));
+            return JSValue::encode(jsNumber(index));
     }
 
-    return JSValue::encode(jsNumber(exec, -1));
+    return JSValue::encode(jsNumber(-1));
 }
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
@@ -1067,7 +1067,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length)
-        return JSValue::encode(jsNumber(exec, -1));
+        return JSValue::encode(jsNumber(-1));
 
     unsigned index = length - 1;
     JSValue fromValue = exec->argument(1);
@@ -1076,7 +1076,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
         if (fromDouble < 0) {
             fromDouble += length;
             if (fromDouble < 0)
-                return JSValue::encode(jsNumber(exec, -1));
+                return JSValue::encode(jsNumber(-1));
         }
         if (fromDouble < length)
             index = static_cast<unsigned>(fromDouble);
@@ -1089,10 +1089,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
         if (!e)
             continue;
         if (JSValue::strictEqual(exec, searchElement, e))
-            return JSValue::encode(jsNumber(exec, index));
+            return JSValue::encode(jsNumber(index));
     } while (index--);
 
-    return JSValue::encode(jsNumber(exec, -1));
+    return JSValue::encode(jsNumber(-1));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/BooleanConstructor.cpp b/JavaScriptCore/runtime/BooleanConstructor.cpp
index 953bddc..0167e03 100644
--- a/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -34,7 +34,7 @@ BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalOb
     putDirectWithoutTransition(exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
 // ECMA 15.6.2
diff --git a/JavaScriptCore/runtime/CachedTranscendentalFunction.h b/JavaScriptCore/runtime/CachedTranscendentalFunction.h
index 04f7f62..67c7af8 100644
--- a/JavaScriptCore/runtime/CachedTranscendentalFunction.h
+++ b/JavaScriptCore/runtime/CachedTranscendentalFunction.h
@@ -56,18 +56,18 @@ public:
             fastFree(m_cache);
     }
 
-    JSValue operator() (ExecState* exec, double operand)
+    JSValue operator() (double operand)
     {
         if (UNLIKELY(!m_cache))
             initialize();
         CacheEntry* entry = &m_cache[hash(operand)];
 
         if (entry->operand == operand)
-            return jsDoubleNumber(exec, entry->result);
+            return jsDoubleNumber(entry->result);
         double result = orignalFunction(operand);
         entry->operand = operand;
         entry->result = result;
-        return jsDoubleNumber(exec, result);
+        return jsDoubleNumber(result);
     }
 
 private:
diff --git a/JavaScriptCore/runtime/CallData.cpp b/JavaScriptCore/runtime/CallData.cpp
index 2b9302a..018e2ca 100644
--- a/JavaScriptCore/runtime/CallData.cpp
+++ b/JavaScriptCore/runtime/CallData.cpp
@@ -35,7 +35,7 @@ namespace JSC {
 JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     ASSERT(callType == CallTypeJS || callType == CallTypeHost);
-    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args, exec->exceptionSlot());
+    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/Completion.cpp b/JavaScriptCore/runtime/Completion.cpp
index 9af5171..eeb8b0d 100644
--- a/JavaScriptCore/runtime/Completion.cpp
+++ b/JavaScriptCore/runtime/Completion.cpp
@@ -59,10 +59,12 @@ Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& s
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValue exception;
-    JSValue result = exec->interpreter()->execute(program.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue result = exec->interpreter()->execute(program.get(), exec, scopeChain.node(), thisObj);
+
+    if (exec->hadException()) {
+        JSValue exception = exec->exception();
+        exec->clearException();
 
-    if (exception) {
         ComplType exceptionType = Throw;
         if (exception.isObject())
             exceptionType = asObject(exception)->exceptionType();
diff --git a/JavaScriptCore/runtime/ConstructData.cpp b/JavaScriptCore/runtime/ConstructData.cpp
index 0d27e25..5da2a91 100644
--- a/JavaScriptCore/runtime/ConstructData.cpp
+++ b/JavaScriptCore/runtime/ConstructData.cpp
@@ -36,7 +36,7 @@ namespace JSC {
 JSObject* construct(ExecState* exec, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     ASSERT(constructType == ConstructTypeJS || constructType == ConstructTypeHost);
-    return exec->interpreter()->executeConstruct(exec, asObject(constructorObject), constructType, constructData, args, exec->exceptionSlot());
+    return exec->interpreter()->executeConstruct(exec, asObject(constructorObject), constructType, constructData, args);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/DateConstructor.cpp b/JavaScriptCore/runtime/DateConstructor.cpp
index 49e0405..dcbe12d 100644
--- a/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/JavaScriptCore/runtime/DateConstructor.cpp
@@ -67,7 +67,7 @@ DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject,
       putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
       putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
-      putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 7), ReadOnly | DontEnum | DontDelete);
+      putDirectWithoutTransition(exec->propertyNames().length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
 }
 
 // ECMA 15.9.3
@@ -159,12 +159,12 @@ CallType DateConstructor::getCallData(CallData& callData)
 
 static EncodedJSValue JSC_HOST_CALL dateParse(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, parseDate(exec, exec->argument(0).toString(exec))));
+    return JSValue::encode(jsNumber(parseDate(exec, exec->argument(0).toString(exec))));
 }
 
-static EncodedJSValue JSC_HOST_CALL dateNow(ExecState* exec)
+static EncodedJSValue JSC_HOST_CALL dateNow(ExecState*)
 {
-    return JSValue::encode(jsNumber(exec, jsCurrentTime()));
+    return JSValue::encode(jsNumber(jsCurrentTime()));
 }
 
 static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState* exec) 
@@ -186,7 +186,7 @@ static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState* exec)
             || (n >= 5 && isnan(doubleArguments[4]))
             || (n >= 6 && isnan(doubleArguments[5]))
             || (n >= 7 && isnan(doubleArguments[6])))
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
 
     GregorianDateTime t;
     int year = JSC::toInt32(doubleArguments[0]);
@@ -197,7 +197,7 @@ static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState* exec)
     t.minute = JSC::toInt32(doubleArguments[4]);
     t.second = JSC::toInt32(doubleArguments[5]);
     double ms = (n >= 7) ? doubleArguments[6] : 0;
-    return JSValue::encode(jsNumber(exec, timeClip(gregorianDateTimeToMS(exec, t, ms, true))));
+    return JSValue::encode(jsNumber(timeClip(gregorianDateTimeToMS(exec, t, ms, true))));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/DateInstance.cpp b/JavaScriptCore/runtime/DateInstance.cpp
index b43b183..8562e2d 100644
--- a/JavaScriptCore/runtime/DateInstance.cpp
+++ b/JavaScriptCore/runtime/DateInstance.cpp
@@ -34,22 +34,22 @@ namespace JSC {
 
 const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+DateInstance::DateInstance(ExecState*, NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
 {
-    setInternalValue(jsNaN(exec));
+    setInternalValue(jsNaN());
 }
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+DateInstance::DateInstance(ExecState*, NonNullPassRefPtr<Structure> structure, double time)
     : JSWrapperObject(structure)
 {
-    setInternalValue(jsNumber(exec, timeClip(time)));
+    setInternalValue(jsNumber(timeClip(time)));
 }
 
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
 {
-    setInternalValue(jsNumber(exec, timeClip(time)));
+    setInternalValue(jsNumber(timeClip(time)));
 }
 
 const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
diff --git a/JavaScriptCore/runtime/DatePrototype.cpp b/JavaScriptCore/runtime/DatePrototype.cpp
index 4983f29..085cb33 100644
--- a/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/JavaScriptCore/runtime/DatePrototype.cpp
@@ -182,7 +182,7 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMil
     // We truncate the string returned from CFDateFormatter if it's absurdly long (> 200 characters).
     // That's not great error handling, but it just won't happen so it doesn't matter.
     UChar buffer[200];
-    const size_t bufferLength = sizeof(buffer) / sizeof(buffer[0]);
+    const size_t bufferLength = WTF_ARRAY_LENGTH(buffer);
     size_t length = CFStringGetLength(string);
     ASSERT(length <= bufferLength);
     if (length > bufferLength)
@@ -585,8 +585,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, 1900 + gregorianDateTime->year));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
@@ -599,8 +599,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, 1900 + gregorianDateTime->year));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec)
@@ -631,8 +631,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->month));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->month));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
@@ -645,8 +645,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->month));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->month));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
@@ -659,8 +659,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->monthDay));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
@@ -673,8 +673,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->monthDay));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
@@ -687,8 +687,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->weekDay));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
@@ -701,8 +701,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->weekDay));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
@@ -715,8 +715,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->hour));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->hour));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
@@ -729,8 +729,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->hour));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->hour));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
@@ -743,8 +743,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->minute));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->minute));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
@@ -757,8 +757,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->minute));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->minute));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
@@ -771,8 +771,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->second));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->second));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
@@ -785,8 +785,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->second));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->second));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
@@ -798,11 +798,11 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
     if (isnan(milli))
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
 
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
-    return JSValue::encode(jsNumber(exec, ms));
+    return JSValue::encode(jsNumber(ms));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
@@ -814,11 +814,11 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
     if (isnan(milli))
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
 
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
-    return JSValue::encode(jsNumber(exec, ms));
+    return JSValue::encode(jsNumber(ms));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
@@ -831,8 +831,8 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, -gregorianDateTime->utcOffset / minutesPerHour));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(-gregorianDateTime->utcOffset / minutesPerHour));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
@@ -844,7 +844,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
     double milli = timeClip(exec->argument(0).toNumber(exec));
-    JSValue result = jsNumber(exec, milli);
+    JSValue result = jsNumber(milli);
     thisDateObj->setInternalValue(result);
     return JSValue::encode(result);
 }
@@ -859,7 +859,7 @@ static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse,
     double milli = thisDateObj->internalNumber();
     
     if (!exec->argumentCount() || isnan(milli)) {
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     }
@@ -871,17 +871,17 @@ static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse,
         ? thisDateObj->gregorianDateTimeUTC(exec)
         : thisDateObj->gregorianDateTime(exec);
     if (!other)
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
 
     GregorianDateTime gregorianDateTime;
     gregorianDateTime.copyFrom(*other);
     if (!fillStructuresUsingTimeArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     } 
     
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
+    JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return JSValue::encode(result);
 }
@@ -894,7 +894,7 @@ static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse,
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (!exec->argumentCount()) {
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     }      
@@ -911,17 +911,17 @@ static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse,
             ? thisDateObj->gregorianDateTimeUTC(exec)
             : thisDateObj->gregorianDateTime(exec);
         if (!other)
-            return JSValue::encode(jsNaN(exec));
+            return JSValue::encode(jsNaN());
         gregorianDateTime.copyFrom(*other);
     }
     
     if (!fillStructuresUsingDateArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     } 
            
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
+    JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return JSValue::encode(result);
 }
@@ -1018,7 +1018,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (!exec->argumentCount()) { 
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     }
@@ -1040,13 +1040,13 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
     
     double year = exec->argument(0).toIntegerPreserveNaN(exec);
     if (!isfinite(year)) {
-        JSValue result = jsNaN(exec);
+        JSValue result = jsNaN();
         thisDateObj->setInternalValue(result);
         return JSValue::encode(result);
     }
             
     gregorianDateTime.year = toInt32((year > 99 || year < 0) ? year - 1900 : year);
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
+    JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(result);
     return JSValue::encode(result);
 }
@@ -1061,10 +1061,10 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
 
     // NOTE: IE returns the full year even in getYear.
-    return JSValue::encode(jsNumber(exec, gregorianDateTime->year));
+    return JSValue::encode(jsNumber(gregorianDateTime->year));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
diff --git a/JavaScriptCore/runtime/Error.cpp b/JavaScriptCore/runtime/Error.cpp
index e35424b..fd97beb 100644
--- a/JavaScriptCore/runtime/Error.cpp
+++ b/JavaScriptCore/runtime/Error.cpp
@@ -45,43 +45,43 @@ static const char* expressionEndOffsetPropertyName = "expressionEndOffset";
 JSObject* createError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->errorStructure(), message);
 }
 
 JSObject* createEvalError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->evalErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->evalErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createRangeError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->rangeErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->rangeErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createReferenceError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->referenceErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->referenceErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createSyntaxError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->syntaxErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->syntaxErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createTypeError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->typeErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->typeErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createURIError(JSGlobalObject* globalObject, const UString& message)
 {
     ASSERT(!message.isEmpty());
-    return ErrorInstance::create(globalObject->globalData(), globalObject->URIErrorConstructor()->errorStructure(), message);
+    return ErrorInstance::create(&globalObject->globalData(), globalObject->URIErrorConstructor()->errorStructure(), message);
 }
 
 JSObject* createError(ExecState* exec, const UString& message)
@@ -125,19 +125,19 @@ static void addErrorSourceInfo(JSGlobalData* globalData, JSObject* error, int li
     const UString& sourceURL = source.provider()->url();
 
     if (line != -1)
-        error->putWithAttributes(globalData, Identifier(globalData, linePropertyName), jsNumber(globalData, line), ReadOnly | DontDelete);
+        error->putWithAttributes(globalData, Identifier(globalData, linePropertyName), jsNumber(line), ReadOnly | DontDelete);
     if (sourceID != -1)
-        error->putWithAttributes(globalData, Identifier(globalData, sourceIdPropertyName), jsNumber(globalData, (double)sourceID), ReadOnly | DontDelete);
+        error->putWithAttributes(globalData, Identifier(globalData, sourceIdPropertyName), jsNumber((double)sourceID), ReadOnly | DontDelete);
     if (!sourceURL.isNull())
         error->putWithAttributes(globalData, Identifier(globalData, sourceURLPropertyName), jsString(globalData, sourceURL), ReadOnly | DontDelete);
 }
 
 static void addErrorDivotInfo(JSGlobalData* globalData, JSObject* error, int divotPoint, int startOffset, int endOffset, bool withCaret)
 {
-    error->putWithAttributes(globalData, Identifier(globalData, expressionBeginOffsetPropertyName), jsNumber(globalData, divotPoint - startOffset), ReadOnly | DontDelete);
-    error->putWithAttributes(globalData, Identifier(globalData, expressionEndOffsetPropertyName), jsNumber(globalData, divotPoint + endOffset), ReadOnly | DontDelete);
+    error->putWithAttributes(globalData, Identifier(globalData, expressionBeginOffsetPropertyName), jsNumber(divotPoint - startOffset), ReadOnly | DontDelete);
+    error->putWithAttributes(globalData, Identifier(globalData, expressionEndOffsetPropertyName), jsNumber(divotPoint + endOffset), ReadOnly | DontDelete);
     if (withCaret)
-        error->putWithAttributes(globalData, Identifier(globalData, expressionCaretOffsetPropertyName), jsNumber(globalData, divotPoint), ReadOnly | DontDelete);
+        error->putWithAttributes(globalData, Identifier(globalData, expressionCaretOffsetPropertyName), jsNumber(divotPoint), ReadOnly | DontDelete);
 }
 
 JSObject* addErrorInfo(JSGlobalData* globalData, JSObject* error, int line, const SourceCode& source)
diff --git a/JavaScriptCore/runtime/ErrorConstructor.cpp b/JavaScriptCore/runtime/ErrorConstructor.cpp
index a0874d4..4326a4d 100644
--- a/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -34,7 +34,7 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject
 {
     // ECMA 15.11.3.1 Error.prototype
     putDirectWithoutTransition(exec->propertyNames().prototype, errorPrototype, DontEnum | DontDelete | ReadOnly);
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum);
 }
 
 // ECMA 15.9.3
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.cpp b/JavaScriptCore/runtime/ExceptionHelpers.cpp
index a1e28d1..5fbaa18 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -187,14 +187,19 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     return exception;
 }
 
-JSValue throwOutOfMemoryError(ExecState* exec)
+JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName)
+{
+    return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
+}    
+
+JSObject* throwOutOfMemoryError(ExecState* exec)
 {
     return throwError(exec, createError(exec, "Out of memory"));
 }
 
-JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName)
+JSObject* throwStackOverflowError(ExecState* exec)
 {
-    return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
-}    
+    return throwError(exec, createStackOverflowError(exec));
+}
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.h b/JavaScriptCore/runtime/ExceptionHelpers.h
index 9b6f1f2..a7b2ca7 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -53,9 +53,11 @@ namespace JSC {
     JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
-    JSValue throwOutOfMemoryError(ExecState*);
     JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const UString&);
 
+    JSObject* throwOutOfMemoryError(ExecState*);
+    JSObject* throwStackOverflowError(ExecState*);
+
 } // namespace JSC
 
 #endif // ExceptionHelpers_h
diff --git a/JavaScriptCore/runtime/FunctionConstructor.cpp b/JavaScriptCore/runtime/FunctionConstructor.cpp
index 9b59720..45b4802 100644
--- a/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -43,7 +43,7 @@ FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* global
     putDirectWithoutTransition(exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
 
     // Number of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithFunctionConstructor(ExecState* exec)
@@ -97,7 +97,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     }
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    JSGlobalData* globalData = globalObject->globalData();
+    JSGlobalData& globalData = globalObject->globalData();
     SourceCode source = makeSource(program, sourceURL, lineNumber);
     JSObject* exception = 0;
     RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
@@ -106,7 +106,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
         return throwError(exec, exception);
     }
 
-    ScopeChain scopeChain(globalObject, globalData, globalObject, exec->globalThisValue());
+    ScopeChain scopeChain(globalObject, &globalData, globalObject, exec->globalThisValue());
     return new (exec) JSFunction(exec, function, scopeChain.node());
 }
 
diff --git a/JavaScriptCore/runtime/FunctionPrototype.cpp b/JavaScriptCore/runtime/FunctionPrototype.cpp
index ef42cdc..cd7739d 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -41,7 +41,7 @@ static EncodedJSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*);
 FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), globalObject, structure, exec->propertyNames().nullIdentifier)
 {
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
 }
 
 void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
diff --git a/JavaScriptCore/runtime/GetterSetter.h b/JavaScriptCore/runtime/GetterSetter.h
index 27ffbe7..e7b1938 100644
--- a/JavaScriptCore/runtime/GetterSetter.h
+++ b/JavaScriptCore/runtime/GetterSetter.h
@@ -64,8 +64,8 @@ namespace JSC {
 
     inline GetterSetter* asGetterSetter(JSValue value)
     {
-        ASSERT(asCell(value)->isGetterSetter());
-        return static_cast<GetterSetter*>(asCell(value));
+        ASSERT(value.asCell()->isGetterSetter());
+        return static_cast<GetterSetter*>(value.asCell());
     }
 
 
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index dae807f..b8b92f4 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -278,7 +278,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
 bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
-        slot.setValue(jsNumber(exec, length()));
+        slot.setValue(jsNumber(length()));
         return true;
     }
 
@@ -293,7 +293,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
 bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, length()), DontDelete | DontEnum);
+        descriptor.setDescriptor(jsNumber(length()), DontDelete | DontEnum);
         return true;
     }
 
@@ -1085,7 +1085,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     tree.abstractor().m_nodes.grow(nodeCount);
 
     if (callType == CallTypeJS)
-        tree.abstractor().m_cachedCall = adoptPtr(new CachedCall(exec, asFunction(compareFunction), 2, exec->exceptionSlot()));
+        tree.abstractor().m_cachedCall = adoptPtr(new CachedCall(exec, asFunction(compareFunction), 2));
 
     if (!tree.abstractor().m_nodes.begin()) {
         throwOutOfMemoryError(exec);
diff --git a/JavaScriptCore/runtime/JSByteArray.cpp b/JavaScriptCore/runtime/JSByteArray.cpp
index 88519cf..6af9d75 100644
--- a/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/JavaScriptCore/runtime/JSByteArray.cpp
@@ -40,7 +40,7 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
     , m_storage(storage)
     , m_classInfo(classInfo)
 {
-    putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
+    putDirect(exec->globalData().propertyNames->length, jsNumber(m_storage->length()), ReadOnly | DontDelete);
 }
 
 #if !ASSERT_DISABLED
diff --git a/JavaScriptCore/runtime/JSByteArray.h b/JavaScriptCore/runtime/JSByteArray.h
index e9a6c64..44bae2d 100644
--- a/JavaScriptCore/runtime/JSByteArray.h
+++ b/JavaScriptCore/runtime/JSByteArray.h
@@ -36,10 +36,10 @@ namespace JSC {
         friend class JSGlobalData;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
-        JSValue getIndex(ExecState* exec, unsigned i)
+        JSValue getIndex(ExecState*, unsigned i)
         {
             ASSERT(canAccessIndex(i));
-            return jsNumber(exec, m_storage->data()[i]);
+            return jsNumber(m_storage->data()[i]);
         }
 
         void setIndex(unsigned i, int value)
@@ -106,7 +106,7 @@ namespace JSC {
     JSByteArray* asByteArray(JSValue value);
     inline JSByteArray* asByteArray(JSValue value)
     {
-        return static_cast<JSByteArray*>(asCell(value));
+        return static_cast<JSByteArray*>(value.asCell());
     }
 
     inline bool isJSByteArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsByteArrayVPtr; }
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index 1a7f8b2..7d4929d 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -216,14 +216,14 @@ namespace JSC {
 
     inline CallType getCallData(JSValue value, CallData& callData)
     {
-        CallType result = value.isCell() ? asCell(value)->getCallData(callData) : CallTypeNone;
+        CallType result = value.isCell() ? value.asCell()->getCallData(callData) : CallTypeNone;
         ASSERT(result == CallTypeNone || value.isValidCallee());
         return result;
     }
 
     inline ConstructType getConstructData(JSValue value, ConstructData& constructData)
     {
-        ConstructType result = value.isCell() ? asCell(value)->getConstructData(constructData) : ConstructTypeNone;
+        ConstructType result = value.isCell() ? value.asCell()->getConstructData(constructData) : ConstructTypeNone;
         ASSERT(result == ConstructTypeNone || value.isValidCallee());
         return result;
     }
diff --git a/JavaScriptCore/runtime/JSFunction.cpp b/JavaScriptCore/runtime/JSFunction.cpp
index fdaa509..0697fc3 100644
--- a/JavaScriptCore/runtime/JSFunction.cpp
+++ b/JavaScriptCore/runtime/JSFunction.cpp
@@ -74,7 +74,7 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
     , m_scopeChain(globalObject->globalScopeChain())
 {
     putDirect(exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
-    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 #endif
 
@@ -87,7 +87,7 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
 {
     putDirect(exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 #if ENABLE(JIT)
-    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 #else
     UNUSED_PARAM(length);
     UNUSED_PARAM(func);
@@ -192,11 +192,11 @@ JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, const Identi
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValue JSFunction::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue JSFunction::lengthGetter(ExecState*, JSValue slotBase, const Identifier&)
 {
     JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
-    return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
+    return jsNumber(thisObj->jsExecutable()->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -266,7 +266,7 @@ bool JSFunction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     }
     
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
+        descriptor.setDescriptor(jsNumber(jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
         return true;
     }
     
diff --git a/JavaScriptCore/runtime/JSGlobalObject.cpp b/JavaScriptCore/runtime/JSGlobalObject.cpp
index 903e573..a8fb7bf 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -116,7 +116,7 @@ JSGlobalObject::~JSGlobalObject()
     for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->clearGlobalObject();
         
-    RegisterFile& registerFile = globalData()->interpreter->registerFile();
+    RegisterFile& registerFile = globalData().interpreter->registerFile();
     if (registerFile.clearGlobalObject(this))
         registerFile.setNumGlobals(0);
     d()->destructor(d());
@@ -301,13 +301,13 @@ void JSGlobalObject::reset(JSValue prototype)
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(Inf), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
     };
 
-    addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
+    addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 
     // Set global functions.
 
@@ -349,9 +349,9 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->markAggregate(markStack);
 
-    RegisterFile& registerFile = globalData()->interpreter->registerFile();
+    RegisterFile& registerFile = globalData().interpreter->registerFile();
     if (registerFile.globalObject() == this)
-        registerFile.markGlobals(markStack, &globalData()->heap);
+        registerFile.markGlobals(markStack, &globalData().heap);
 
     markIfNeeded(markStack, d()->regExpConstructor);
     markIfNeeded(markStack, d()->errorConstructor);
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index 36fa70b..93a1b88 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -276,7 +276,7 @@ namespace JSC {
         
         void resetPrototype(JSValue prototype);
 
-        JSGlobalData* globalData() { return d()->globalData.get(); }
+        JSGlobalData& globalData() { return *d()->globalData.get(); }
         JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index ed06fa5..284806e 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -455,7 +455,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     if (error)
         return throwVMError(exec, error);
 
-    return JSValue::encode(exec->interpreter()->execute(eval.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot()));
+    return JSValue::encode(exec->interpreter()->execute(eval.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node()));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
@@ -464,7 +464,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
     int32_t radix = exec->argument(1).toInt32(exec);
 
     if (radix != 0 && radix != 10)
-        return JSValue::encode(jsNumber(exec, parseInt(value.toString(exec), radix)));
+        return JSValue::encode(jsNumber(parseInt(value.toString(exec), radix)));
 
     if (value.isInt32())
         return JSValue::encode(value);
@@ -472,18 +472,18 @@ EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
     if (value.isDouble()) {
         double d = value.asDouble();
         if (isfinite(d))
-            return JSValue::encode(jsNumber(exec, (d > 0) ? floor(d) : ceil(d)));
+            return JSValue::encode(jsNumber((d > 0) ? floor(d) : ceil(d)));
         if (isnan(d) || isinf(d))
-            return JSValue::encode(jsNaN(exec));
-        return JSValue::encode(jsNumber(exec, 0));
+            return JSValue::encode(jsNaN());
+        return JSValue::encode(jsNumber(0));
     }
 
-    return JSValue::encode(jsNumber(exec, parseInt(value.toString(exec), radix)));
+    return JSValue::encode(jsNumber(parseInt(value.toString(exec), radix)));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseFloat(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, parseFloat(exec->argument(0).toString(exec))));
+    return JSValue::encode(jsNumber(parseFloat(exec->argument(0).toString(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncIsNaN(ExecState* exec)
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index a25c531..0040067 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -36,81 +36,60 @@ namespace JSC {
     extern const double Inf;
 
 #if USE(JSVALUE64)
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
     {
         *this = JSImmediate::fromNumberOutsideIntegerRange(d);
     }
 
-    inline JSValue::JSValue(ExecState*, double d)
+    inline JSValue::JSValue(double d)
     {
         JSValue v = JSImmediate::from(d);
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, int i)
+    inline JSValue::JSValue(int i)
     {
         JSValue v = JSImmediate::from(i);
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, unsigned i)
+    inline JSValue::JSValue(unsigned i)
     {
         JSValue v = JSImmediate::from(i);
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, long i)
+    inline JSValue::JSValue(long i)
     {
         JSValue v = JSImmediate::from(i);
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, unsigned long i)
+    inline JSValue::JSValue(unsigned long i)
     {
         JSValue v = JSImmediate::from(i);
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, long long i)
+    inline JSValue::JSValue(long long i)
     {
         JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(ExecState*, unsigned long long i)
+    inline JSValue::JSValue(unsigned long long i)
     {
         JSValue v = JSImmediate::from(static_cast<double>(i));
         ASSERT(v);
         *this = v;
     }
 
-    inline JSValue::JSValue(JSGlobalData*, double d)
-    {
-        JSValue v = JSImmediate::from(d);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, int i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, unsigned i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
     inline bool JSValue::isDouble() const
     {
         return JSImmediate::isDouble(asValue());
@@ -136,45 +115,40 @@ namespace JSC {
 
 #if USE(JSVALUE64)
 
-    inline JSValue::JSValue(ExecState*, char i)
+    inline JSValue::JSValue(char i)
     {
         ASSERT(JSImmediate::from(i));
         *this = JSImmediate::from(i);
     }
 
-    inline JSValue::JSValue(ExecState*, unsigned char i)
+    inline JSValue::JSValue(unsigned char i)
     {
         ASSERT(JSImmediate::from(i));
         *this = JSImmediate::from(i);
     }
 
-    inline JSValue::JSValue(ExecState*, short i)
+    inline JSValue::JSValue(short i)
     {
         ASSERT(JSImmediate::from(i));
         *this = JSImmediate::from(i);
     }
 
-    inline JSValue::JSValue(ExecState*, unsigned short i)
+    inline JSValue::JSValue(unsigned short i)
     {
         ASSERT(JSImmediate::from(i));
         *this = JSImmediate::from(i);
     }
 
-    inline JSValue jsNaN(ExecState* exec)
-    {
-        return jsNumber(exec, NaN);
-    }
-
-    inline JSValue jsNaN(JSGlobalData* globalData)
+    inline JSValue jsNaN()
     {
-        return jsNumber(globalData, NaN);
+        return jsNumber(NaN);
     }
 
     // --- JSValue inlines ----------------------------
 
     ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
     {
-        return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
+        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
     }
 
     inline bool JSValue::getNumber(double &result) const
diff --git a/JavaScriptCore/runtime/JSONObject.cpp b/JavaScriptCore/runtime/JSONObject.cpp
index 0794189..b5477a1 100644
--- a/JavaScriptCore/runtime/JSONObject.cpp
+++ b/JavaScriptCore/runtime/JSONObject.cpp
@@ -133,7 +133,7 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
         return value;
     JSObject* object = asObject(value);
     if (object->inherits(&NumberObject::info))
-        return jsNumber(exec, object->toNumber(exec));
+        return jsNumber(object->toNumber(exec));
     if (object->inherits(&StringObject::info))
         return jsString(exec, object->toString(exec));
     if (object->inherits(&BooleanObject::info))
@@ -189,7 +189,7 @@ JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
         if (m_identifier)
             m_value = jsString(exec, m_identifier->ustring());
         else
-            m_value = jsNumber(exec, m_number);
+            m_value = jsNumber(m_number);
     }
     return m_value;
 }
@@ -329,7 +329,7 @@ void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& val
                 static const char hexDigits[] = "0123456789abcdef";
                 UChar ch = data[i];
                 UChar hex[] = { '\\', 'u', hexDigits[(ch >> 12) & 0xF], hexDigits[(ch >> 8) & 0xF], hexDigits[(ch >> 4) & 0xF], hexDigits[ch & 0xF] };
-                builder.append(hex, sizeof(hex) / sizeof(UChar));
+                builder.append(hex, WTF_ARRAY_LENGTH(hex));
                 break;
         }
     }
@@ -357,7 +357,7 @@ inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionC
         return value;
 
     JSValue list[] = { propertyName.value(m_exec) };
-    ArgList args(list, sizeof(list) / sizeof(JSValue));
+    ArgList args(list, WTF_ARRAY_LENGTH(list));
     return call(m_exec, object, callType, callData, value, args);
 }
 
@@ -371,7 +371,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     // Call the replacer function.
     if (m_replacerCallType != CallTypeNone) {
         JSValue list[] = { propertyName.value(m_exec), value };
-        ArgList args(list, sizeof(list) / sizeof(JSValue));
+        ArgList args(list, WTF_ARRAY_LENGTH(list));
         value = call(m_exec, m_replacer, m_replacerCallType, m_replacerCallData, holder, args);
         if (m_exec->hadException())
             return StringifyFailed;
@@ -868,7 +868,7 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
 
 UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
 {
-    JSValue result = Stringifier(exec, jsNull(), jsNumber(exec, indent)).stringify(value);
+    JSValue result = Stringifier(exec, jsNull(), jsNumber(indent)).stringify(value);
     if (result.isUndefinedOrNull())
         return UString();
     return result.getString(exec);
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index bc0120f..340a898 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -236,7 +236,7 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
 bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_length), DontEnum | DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsNumber(m_length), DontEnum | DontDelete | ReadOnly);
         return true;
     }
     
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 12ced10..4d81a2f 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -379,8 +379,8 @@ namespace JSC {
         void appendValueInConstructAndIncrementLength(ExecState* exec, unsigned& index, JSValue v)
         {
             if (v.isString()) {
-                ASSERT(asCell(v)->isString());
-                JSString* s = static_cast<JSString*>(asCell(v));
+                ASSERT(v.asCell()->isString());
+                JSString* s = static_cast<JSString*>(v.asCell());
                 ASSERT(s->fiberCount() == 1);
                 appendStringInConstruct(index, s);
                 m_length += s->length();
@@ -451,8 +451,8 @@ namespace JSC {
 
     inline JSString* asString(JSValue value)
     {
-        ASSERT(asCell(value)->isString());
-        return static_cast<JSString*>(asCell(value));
+        ASSERT(value.asCell()->isString());
+        return static_cast<JSString*>(value.asCell());
     }
 
     inline JSString* jsEmptyString(JSGlobalData* globalData)
@@ -559,7 +559,7 @@ namespace JSC {
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
     {
         if (propertyName == exec->propertyNames().length) {
-            slot.setValue(jsNumber(exec, m_length));
+            slot.setValue(jsNumber(m_length));
             return true;
         }
 
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index b5dcbec..cad9662 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -101,21 +101,18 @@ namespace JSC {
         JSValue(const JSCell* ptr);
 
         // Numbers
-        JSValue(EncodeAsDoubleTag, ExecState*, double);
-        JSValue(ExecState*, double);
-        JSValue(ExecState*, char);
-        JSValue(ExecState*, unsigned char);
-        JSValue(ExecState*, short);
-        JSValue(ExecState*, unsigned short);
-        JSValue(ExecState*, int);
-        JSValue(ExecState*, unsigned);
-        JSValue(ExecState*, long);
-        JSValue(ExecState*, unsigned long);
-        JSValue(ExecState*, long long);
-        JSValue(ExecState*, unsigned long long);
-        JSValue(JSGlobalData*, double);
-        JSValue(JSGlobalData*, int);
-        JSValue(JSGlobalData*, unsigned);
+        JSValue(EncodeAsDoubleTag, double);
+        explicit JSValue(double);
+        explicit JSValue(char);
+        explicit JSValue(unsigned char);
+        explicit JSValue(short);
+        explicit JSValue(unsigned short);
+        explicit JSValue(int);
+        explicit JSValue(unsigned);
+        explicit JSValue(long);
+        explicit JSValue(unsigned long);
+        explicit JSValue(long long);
+        explicit JSValue(unsigned long long);
 
         operator bool() const;
         bool operator==(const JSValue& other) const;
@@ -226,12 +223,12 @@ namespace JSC {
         JSObject* synthesizeObject(ExecState*) const;
 
 #if USE(JSVALUE32_64)
-        enum { Int32Tag =        0xffffffff };
-        enum { CellTag =         0xfffffffe };
-        enum { TrueTag =         0xfffffffd };
-        enum { FalseTag =        0xfffffffc };
-        enum { NullTag =         0xfffffffb };
-        enum { UndefinedTag =    0xfffffffa };
+        enum { NullTag =         0xffffffff };
+        enum { UndefinedTag =    0xfffffffe };
+        enum { Int32Tag =        0xfffffffd };
+        enum { CellTag =         0xfffffffc };
+        enum { TrueTag =         0xfffffffb };
+        enum { FalseTag =        0xfffffffa };
         enum { EmptyValueTag =   0xfffffff9 };
         enum { DeletedValueTag = 0xfffffff8 };
         
@@ -294,79 +291,64 @@ namespace JSC {
         return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
     }
 
-    ALWAYS_INLINE JSValue jsDoubleNumber(ExecState* exec, double d)
+    ALWAYS_INLINE JSValue jsDoubleNumber(double d)
     {
-        return JSValue(JSValue::EncodeAsDouble, exec, d);
+        return JSValue(JSValue::EncodeAsDouble, d);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
+    ALWAYS_INLINE JSValue jsNumber(double d)
     {
-        return JSValue(exec, d);
+        return JSValue(d);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, char i)
+    ALWAYS_INLINE JSValue jsNumber(char i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned char i)
+    ALWAYS_INLINE JSValue jsNumber(unsigned char i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, short i)
+    ALWAYS_INLINE JSValue jsNumber(short i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned short i)
+    ALWAYS_INLINE JSValue jsNumber(unsigned short i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, int i)
+    ALWAYS_INLINE JSValue jsNumber(int i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned i)
+    ALWAYS_INLINE JSValue jsNumber(unsigned i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long i)
+    ALWAYS_INLINE JSValue jsNumber(long i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long i)
+    ALWAYS_INLINE JSValue jsNumber(unsigned long i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long long i)
+    ALWAYS_INLINE JSValue jsNumber(long long i)
     {
-        return JSValue(exec, i);
+        return JSValue(i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long long i)
+    ALWAYS_INLINE JSValue jsNumber(unsigned long long i)
     {
-        return JSValue(exec, i);
-    }
-
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, double d)
-    {
-        return JSValue(globalData, d);
-    }
-
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
-    {
-        return JSValue(globalData, i);
-    }
-
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
-    {
-        return JSValue(globalData, i);
+        return JSValue(i);
     }
 
     inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
@@ -375,14 +357,6 @@ namespace JSC {
     inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
     inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
 
-    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
-    JSCell* asCell(JSValue);
-
-    inline JSCell* asCell(JSValue value)
-    {
-        return value.asCell();
-    }
-
     ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
         if (isInt32())
@@ -397,9 +371,9 @@ namespace JSC {
     }
 
 #if USE(JSVALUE32_64)
-    inline JSValue jsNaN(ExecState* exec)
+    inline JSValue jsNaN()
     {
-        return JSValue(exec, nonInlineNaN());
+        return JSValue(nonInlineNaN());
     }
 
     // JSValue member functions.
@@ -573,115 +547,90 @@ namespace JSC {
         return reinterpret_cast<JSCell*>(u.asBits.payload);
     }
 
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
     {
         u.asDouble = d;
     }
 
-    inline JSValue::JSValue(ExecState* exec, double d)
+    inline JSValue::JSValue(double d)
     {
         const int32_t asInt32 = static_cast<int32_t>(d);
         if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
             u.asDouble = d;
             return;
         }
-        *this = JSValue(exec, static_cast<int32_t>(d));
+        *this = JSValue(static_cast<int32_t>(d));
     }
 
-    inline JSValue::JSValue(ExecState* exec, char i)
+    inline JSValue::JSValue(char i)
     {
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, unsigned char i)
+    inline JSValue::JSValue(unsigned char i)
     {
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, short i)
+    inline JSValue::JSValue(short i)
     {
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, unsigned short i)
+    inline JSValue::JSValue(unsigned short i)
     {
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState*, int i)
+    inline JSValue::JSValue(int i)
     {
         u.asBits.tag = Int32Tag;
         u.asBits.payload = i;
     }
 
-    inline JSValue::JSValue(ExecState* exec, unsigned i)
+    inline JSValue::JSValue(unsigned i)
     {
         if (static_cast<int32_t>(i) < 0) {
-            *this = JSValue(exec, static_cast<double>(i));
+            *this = JSValue(static_cast<double>(i));
             return;
         }
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, long i)
+    inline JSValue::JSValue(long i)
     {
         if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(exec, static_cast<double>(i));
+            *this = JSValue(static_cast<double>(i));
             return;
         }
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, unsigned long i)
+    inline JSValue::JSValue(unsigned long i)
     {
         if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(exec, static_cast<double>(i));
+            *this = JSValue(static_cast<double>(i));
             return;
         }
-        *this = JSValue(exec, static_cast<uint32_t>(i));
+        *this = JSValue(static_cast<uint32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, long long i)
+    inline JSValue::JSValue(long long i)
     {
         if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(exec, static_cast<double>(i));
+            *this = JSValue(static_cast<double>(i));
             return;
         }
-        *this = JSValue(exec, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<int32_t>(i));
     }
 
-    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
+    inline JSValue::JSValue(unsigned long long i)
     {
         if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(exec, static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(exec, static_cast<uint32_t>(i));
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, double d)
-    {
-        const int32_t asInt32 = static_cast<int32_t>(d);
-        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
-            u.asDouble = d;
-            return;
-        }
-        *this = JSValue(globalData, static_cast<int32_t>(d));
-    }
-    
-    inline JSValue::JSValue(JSGlobalData*, int i)
-    {
-        u.asBits.tag = Int32Tag;
-        u.asBits.payload = i;
-    }
-    
-    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
-    {
-        if (static_cast<int32_t>(i) < 0) {
-            *this = JSValue(globalData, static_cast<double>(i));
+            *this = JSValue(static_cast<double>(i));
             return;
         }
-        *this = JSValue(globalData, static_cast<int32_t>(i));
+        *this = JSValue(static_cast<uint32_t>(i));
     }
 
     inline bool JSValue::isNumber() const
@@ -722,7 +671,7 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
     {
-        return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
+        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
     }
 
     inline bool JSValue::getNumber(double& result) const
diff --git a/JavaScriptCore/runtime/LiteralParser.cpp b/JavaScriptCore/runtime/LiteralParser.cpp
index f1df15f..ed69f4d 100644
--- a/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/JavaScriptCore/runtime/LiteralParser.cpp
@@ -393,7 +393,7 @@ JSValue LiteralParser::parse(ParserState initialState)
                     case TokNumber: {
                         Lexer::LiteralParserToken numberToken = m_lexer.currentToken();
                         m_lexer.next();
-                        lastValue = jsNumber(m_exec, numberToken.numberToken);
+                        lastValue = jsNumber(numberToken.numberToken);
                         break;
                     }
                     case TokNull:
diff --git a/JavaScriptCore/runtime/MathObject.cpp b/JavaScriptCore/runtime/MathObject.cpp
index 8d2ae2d..080d7d2 100644
--- a/JavaScriptCore/runtime/MathObject.cpp
+++ b/JavaScriptCore/runtime/MathObject.cpp
@@ -89,14 +89,14 @@ const ClassInfo MathObject::info = { "Math", 0, 0, ExecState::mathTable };
 MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
-    putDirectWithoutTransition(Identifier(exec, "E"), jsNumber(exec, exp(1.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LN2"), jsNumber(exec, log(2.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LN10"), jsNumber(exec, log(10.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LOG2E"), jsNumber(exec, 1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LOG10E"), jsNumber(exec, 1.0 / log(10.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "E"), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "LN2"), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "LN10"), jsNumber(log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "LOG2E"), jsNumber(1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "LOG10E"), jsNumber(1.0 / log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(piDouble), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
 }
 
 // ECMA 15.8
@@ -115,54 +115,54 @@ bool MathObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, fabs(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsNumber(fabs(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, acos(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(acos(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, asin(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(asin(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, atan(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(atan(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec)
 {
     double arg0 = exec->argument(0).toNumber(exec);
     double arg1 = exec->argument(1).toNumber(exec);
-    return JSValue::encode(jsDoubleNumber(exec, atan2(arg0, arg1)));
+    return JSValue::encode(jsDoubleNumber(atan2(arg0, arg1)));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, ceil(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsNumber(ceil(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, cos(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(cos(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, exp(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(exp(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, floor(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsNumber(floor(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, log(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(log(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec)
@@ -178,7 +178,7 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec)
         if (val > result || (val == 0 && result == 0 && !signbit(val)))
             result = val;
     }
-    return JSValue::encode(jsNumber(exec, result));
+    return JSValue::encode(jsNumber(result));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec)
@@ -194,7 +194,7 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec)
         if (val < result || (val == 0 && result == 0 && signbit(val)))
             result = val;
     }
-    return JSValue::encode(jsNumber(exec, result));
+    return JSValue::encode(jsNumber(result));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec)
@@ -205,37 +205,37 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec)
     double arg2 = exec->argument(1).toNumber(exec);
 
     if (isnan(arg2))
-        return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNaN());
     if (isinf(arg2) && fabs(arg) == 1)
-        return JSValue::encode(jsNaN(exec));
-    return JSValue::encode(jsNumber(exec, pow(arg, arg2)));
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(pow(arg, arg2)));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, exec->lexicalGlobalObject()->weakRandomNumber()));
+    return JSValue::encode(jsDoubleNumber(exec->lexicalGlobalObject()->weakRandomNumber()));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec)
 {
     double arg = exec->argument(0).toNumber(exec);
     double integer = ceil(arg);
-    return JSValue::encode(jsNumber(exec, integer - (integer - arg > 0.5)));
+    return JSValue::encode(jsNumber(integer - (integer - arg > 0.5)));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec)
 {
-    return JSValue::encode(exec->globalData().cachedSin(exec, exec->argument(0).toNumber(exec)));
+    return JSValue::encode(exec->globalData().cachedSin(exec->argument(0).toNumber(exec)));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, sqrt(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(sqrt(exec->argument(0).toNumber(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec)
 {
-    return JSValue::encode(jsDoubleNumber(exec, tan(exec->argument(0).toNumber(exec))));
+    return JSValue::encode(jsDoubleNumber(tan(exec->argument(0).toNumber(exec))));
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 31f9bc3..eb508eb 100644
--- a/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -37,7 +37,7 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject*
 {
     NativeErrorPrototype* prototype = new (exec) NativeErrorPrototype(exec, globalObject, prototypeStructure, nameAndMessage, this);
 
-    putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
+    putDirect(exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
     putDirect(exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
     m_errorStructure = ErrorInstance::createStructure(prototype);
 }
diff --git a/JavaScriptCore/runtime/NumberConstructor.cpp b/JavaScriptCore/runtime/NumberConstructor.cpp
index a197952..5369ca0 100644
--- a/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -61,7 +61,7 @@ NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObje
     putDirectWithoutTransition(exec->propertyNames().prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 }
 
 bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -74,29 +74,29 @@ bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
 }
 
-static JSValue numberConstructorNaNValue(ExecState* exec, JSValue, const Identifier&)
+static JSValue numberConstructorNaNValue(ExecState*, JSValue, const Identifier&)
 {
-    return jsNaN(exec);
+    return jsNaN();
 }
 
-static JSValue numberConstructorNegInfinity(ExecState* exec, JSValue, const Identifier&)
+static JSValue numberConstructorNegInfinity(ExecState*, JSValue, const Identifier&)
 {
-    return jsNumber(exec, -Inf);
+    return jsNumber(-Inf);
 }
 
-static JSValue numberConstructorPosInfinity(ExecState* exec, JSValue, const Identifier&)
+static JSValue numberConstructorPosInfinity(ExecState*, JSValue, const Identifier&)
 {
-    return jsNumber(exec, Inf);
+    return jsNumber(Inf);
 }
 
-static JSValue numberConstructorMaxValue(ExecState* exec, JSValue, const Identifier&)
+static JSValue numberConstructorMaxValue(ExecState*, JSValue, const Identifier&)
 {
-    return jsNumber(exec, 1.7976931348623157E+308);
+    return jsNumber(1.7976931348623157E+308);
 }
 
-static JSValue numberConstructorMinValue(ExecState* exec, JSValue, const Identifier&)
+static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&)
 {
-    return jsNumber(exec, 5E-324);
+    return jsNumber(5E-324);
 }
 
 // ECMA 15.7.1
@@ -104,7 +104,7 @@ static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* ex
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
     double n = exec->argumentCount() ? exec->argument(0).toNumber(exec) : 0;
-    object->setInternalValue(jsNumber(exec, n));
+    object->setInternalValue(jsNumber(n));
     return JSValue::encode(object);
 }
 
@@ -117,7 +117,7 @@ ConstructType NumberConstructor::getConstructData(ConstructData& constructData)
 // ECMA 15.7.2
 static EncodedJSValue JSC_HOST_CALL callNumberConstructor(ExecState* exec)
 {
-    return JSValue::encode(jsNumber(exec, !exec->argumentCount() ? 0 : exec->argument(0).toNumber(exec)));
+    return JSValue::encode(jsNumber(!exec->argumentCount() ? 0 : exec->argument(0).toNumber(exec)));
 }
 
 CallType NumberConstructor::getCallData(CallData& callData)
diff --git a/JavaScriptCore/runtime/NumberPrototype.cpp b/JavaScriptCore/runtime/NumberPrototype.cpp
index 4a2ca74..0b86c00 100644
--- a/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -49,7 +49,7 @@ static EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*);
 NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : NumberObject(structure)
 {
-    setInternalValue(jsNumber(exec, 0));
+    setInternalValue(jsNumber(0));
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index b1f9d70..ca3dcd7 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -50,7 +50,7 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObje
     putDirectWithoutTransition(exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
     
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
     
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
diff --git a/JavaScriptCore/runtime/Operations.cpp b/JavaScriptCore/runtime/Operations.cpp
index cf236bf..f129a80 100644
--- a/JavaScriptCore/runtime/Operations.cpp
+++ b/JavaScriptCore/runtime/Operations.cpp
@@ -55,7 +55,7 @@ NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
     if (p2.isString())
         return jsString(callFrame, p1.toString(callFrame), asString(p2));
 
-    return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
+    return jsNumber(p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
 
 JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
@@ -85,7 +85,7 @@ bool jsIsObjectType(JSValue v)
     if (!v.isCell())
         return v.isNull();
 
-    JSType type = asCell(v)->structure()->typeInfo().type();
+    JSType type = v.asCell()->structure()->typeInfo().type();
     if (type == NumberType || type == StringType)
         return false;
     if (type == ObjectType) {
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index 9226953..1252345 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -398,7 +398,7 @@ namespace JSC {
     {
         double left = 0.0, right;
         if (v1.getNumber(left) && v2.getNumber(right))
-            return jsNumber(callFrame, left + right);
+            return jsNumber(left + right);
         
         if (v1.isString()) {
             return v2.isString()
@@ -412,7 +412,7 @@ namespace JSC {
 
     inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
     {
-        JSCell* cell = asCell(base);
+        JSCell* cell = base.asCell();
         size_t count = 0;
 
         while (slotBase != cell) {
@@ -424,7 +424,7 @@ namespace JSC {
             if (v.isNull())
                 return 0;
 
-            cell = asCell(v);
+            cell = v.asCell();
 
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
@@ -449,7 +449,7 @@ namespace JSC {
             if (v.isNull())
                 return count;
 
-            base = asCell(v);
+            base = v.asCell();
 
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
diff --git a/JavaScriptCore/runtime/Protect.h b/JavaScriptCore/runtime/Protect.h
index a0d5443..06cf97f 100644
--- a/JavaScriptCore/runtime/Protect.h
+++ b/JavaScriptCore/runtime/Protect.h
@@ -52,13 +52,13 @@ namespace JSC {
     inline void gcProtect(JSValue value)
     {
         if (value && value.isCell())
-            gcProtect(asCell(value));
+            gcProtect(value.asCell());
     }
 
     inline void gcUnprotect(JSValue value)
     {
         if (value && value.isCell())
-            gcUnprotect(asCell(value));
+            gcUnprotect(value.asCell());
     }
 
     // FIXME: Share more code with RefPtr template? The only differences are the ref/deref operation
diff --git a/JavaScriptCore/runtime/PrototypeFunction.cpp b/JavaScriptCore/runtime/PrototypeFunction.cpp
index b0bf2bd..3529080 100644
--- a/JavaScriptCore/runtime/PrototypeFunction.cpp
+++ b/JavaScriptCore/runtime/PrototypeFunction.cpp
@@ -37,7 +37,7 @@ PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObje
     , m_function(function)
 {
     ASSERT_ARG(function, function);
-    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 
 PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> prototypeFunctionStructure, int length, const Identifier& name, NativeFunction function)
@@ -45,7 +45,7 @@ PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObje
     , m_function(function)
 {
     ASSERT_ARG(function, function);
-    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
     
 CallType PrototypeFunction::getCallData(CallData& callData)
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index b9aa587..21ca170 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -103,7 +103,7 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObje
     putDirectWithoutTransition(exec->propertyNames().prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
@@ -142,7 +142,7 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
     }
 
     PutPropertySlot slot;
-    JSArray::put(exec, exec->propertyNames().index, jsNumber(exec, d->lastOvector()[0]), slot);
+    JSArray::put(exec, exec->propertyNames().index, jsNumber(d->lastOvector()[0]), slot);
     JSArray::put(exec, exec->propertyNames().input, jsString(exec, d->input), slot);
 
     delete d;
diff --git a/JavaScriptCore/runtime/RegExpObject.cpp b/JavaScriptCore/runtime/RegExpObject.cpp
index 7d14814..7fda5b1 100644
--- a/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/JavaScriptCore/runtime/RegExpObject.cpp
@@ -101,9 +101,9 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
     return jsString(exec, asRegExpObject(slotBase)->regExp()->pattern());
 }
 
-JSValue regExpObjectLastIndex(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue regExpObjectLastIndex(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(exec, asRegExpObject(slotBase)->lastIndex());
+    return jsNumber(asRegExpObject(slotBase)->lastIndex());
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/JavaScriptCore/runtime/StringConstructor.cpp b/JavaScriptCore/runtime/StringConstructor.cpp
index 159386d..101650c 100644
--- a/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/JavaScriptCore/runtime/StringConstructor.cpp
@@ -62,7 +62,7 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 #endif
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 }
 
 // ECMA 15.5.2
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index 37436f9..b5ea8fa 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -136,7 +136,7 @@ StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject,
 {
     putAnonymousValue(0, globalObject);
     // The constructor will be added later, after StringConstructor has been built
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
 }
 
 bool StringPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
@@ -326,7 +326,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
             // reg->numSubpatterns() + 1 for pattern args, + 2 for match start and sourceValue
             int argCount = reg->numSubpatterns() + 1 + 2;
             JSFunction* func = asFunction(replacement);
-            CachedCall cachedCall(exec, func, argCount, exec->exceptionSlot());
+            CachedCall cachedCall(exec, func, argCount);
             if (exec->hadException())
                 return JSValue::encode(jsNull());
             while (true) {
@@ -351,7 +351,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                         cachedCall.setArgument(i, jsSubstring(exec, source, matchStart, matchLen));
                 }
 
-                cachedCall.setArgument(i++, jsNumber(exec, completeMatchStart));
+                cachedCall.setArgument(i++, jsNumber(completeMatchStart));
                 cachedCall.setArgument(i++, sourceVal);
 
                 cachedCall.setThis(exec->globalThisValue());
@@ -398,7 +398,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                             args.append(jsSubstring(exec, source, matchStart, matchLen));
                     }
 
-                    args.append(jsNumber(exec, completeMatchStart));
+                    args.append(jsNumber(completeMatchStart));
                     args.append(sourceVal);
 
                     replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
@@ -454,7 +454,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
     if (callType != CallTypeNone) {
         MarkedArgumentBuffer args;
         args.append(jsSubstring(exec, source, matchPos, matchLen));
-        args.append(jsNumber(exec, matchPos));
+        args.append(jsNumber(matchPos));
         args.append(sourceVal);
 
         replacementString = call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec);
@@ -510,13 +510,13 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec)
     if (a0.isUInt32()) {
         uint32_t i = a0.asUInt32();
         if (i < len)
-            return JSValue::encode(jsNumber(exec, s.characters()[i]));
-        return JSValue::encode(jsNaN(exec));
+            return JSValue::encode(jsNumber(s.characters()[i]));
+        return JSValue::encode(jsNaN());
     }
     double dpos = a0.toInteger(exec);
     if (dpos >= 0 && dpos < len)
-        return JSValue::encode(jsNumber(exec, s[static_cast<int>(dpos)]));
-    return JSValue::encode(jsNaN(exec));
+        return JSValue::encode(jsNumber(s[static_cast<int>(dpos)]));
+    return JSValue::encode(jsNaN());
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec)
@@ -560,8 +560,8 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec)
 
     size_t result = s.find(u2, pos);
     if (result == notFound)
-        return JSValue::encode(jsNumber(exec, -1));
-    return JSValue::encode(jsNumber(exec, result));
+        return JSValue::encode(jsNumber(-1));
+    return JSValue::encode(jsNumber(result));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
@@ -589,8 +589,8 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
 
     size_t result = s.reverseFind(u2, static_cast<unsigned>(dpos));
     if (result == notFound)
-        return JSValue::encode(jsNumber(exec, -1));
-    return JSValue::encode(jsNumber(exec, result));
+        return JSValue::encode(jsNumber(-1));
+    return JSValue::encode(jsNumber(result));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
@@ -672,7 +672,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
     int pos;
     int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
-    return JSValue::encode(jsNumber(exec, pos));
+    return JSValue::encode(jsNumber(pos));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
@@ -909,7 +909,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
-      return JSValue::encode(jsNumber(exec, 0));
+      return JSValue::encode(jsNumber(0));
 
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
@@ -917,7 +917,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
 
     UString s = thisValue.toThisString(exec);
     JSValue a0 = exec->argument(0);
-    return JSValue::encode(jsNumber(exec, localeCompare(s, a0.toString(exec))));
+    return JSValue::encode(jsNumber(localeCompare(s, a0.toString(exec))));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 17cd9b6..b3cd40c 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -90,7 +90,7 @@ UString::UString(const char* characters)
 UString UString::number(int i)
 {
     UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
+    UChar* end = buf + WTF_ARRAY_LENGTH(buf);
     UChar* p = end;
 
     if (i == 0)
@@ -119,7 +119,7 @@ UString UString::number(int i)
 UString UString::number(long long i)
 {
     UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
+    UChar* end = buf + WTF_ARRAY_LENGTH(buf);
     UChar* p = end;
 
     if (i == 0)
@@ -152,7 +152,7 @@ UString UString::number(long long i)
 UString UString::number(unsigned u)
 {
     UChar buf[sizeof(u) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
+    UChar* end = buf + WTF_ARRAY_LENGTH(buf);
     UChar* p = end;
 
     if (u == 0)
@@ -170,7 +170,7 @@ UString UString::number(unsigned u)
 UString UString::number(long l)
 {
     UChar buf[1 + sizeof(l) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
+    UChar* end = buf + WTF_ARRAY_LENGTH(buf);
     UChar* p = end;
 
     if (l == 0)
diff --git a/JavaScriptCore/wtf/Assertions.h b/JavaScriptCore/wtf/Assertions.h
index c4e015d..2907d04 100644
--- a/JavaScriptCore/wtf/Assertions.h
+++ b/JavaScriptCore/wtf/Assertions.h
@@ -44,9 +44,9 @@
 
 #include "Platform.h"
 
-#if COMPILER(MSVC)
 #include <stddef.h>
-#else
+
+#if !COMPILER(MSVC)
 #include <inttypes.h>
 #endif
 
diff --git a/JavaScriptCore/wtf/ByteArray.h b/JavaScriptCore/wtf/ByteArray.h
index f4d34a4..bdec630 100644
--- a/JavaScriptCore/wtf/ByteArray.h
+++ b/JavaScriptCore/wtf/ByteArray.h
@@ -97,6 +97,8 @@ namespace WTF {
         unsigned char m_data[];
 #endif
     };
-}
+} // namespace WTF
+
+using WTF::ByteArray;
 
 #endif
diff --git a/JavaScriptCore/wtf/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
index d005859..f3627e6 100644
--- a/JavaScriptCore/wtf/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -76,6 +76,7 @@
 #include "ASCIICType.h"
 #include "CurrentTime.h"
 #include "MathExtras.h"
+#include "StdLibExtras.h"
 #include "StringExtras.h"
 
 #include <algorithm>
@@ -950,7 +951,7 @@ static double parseDateFromNullTerminatedCharacters(const char* dateString, bool
             }
             haveTZ = true;
         } else {
-            for (int i = 0; i < int(sizeof(known_zones) / sizeof(KnownZone)); i++) {
+            for (size_t i = 0; i < WTF_ARRAY_LENGTH(known_zones); ++i) {
                 if (0 == strncasecmp(dateString, known_zones[i].tzName, strlen(known_zones[i].tzName))) {
                     offset = known_zones[i].tzOffset;
                     dateString += strlen(known_zones[i].tzName);
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 9895824..ac4ef5a 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -210,7 +210,7 @@
     || defined(_ARM_)
 #define WTF_CPU_ARM 1
 
-#if defined(__ARMEB__)
+#if defined(__ARMEB__) || (COMPILER(RVCT) && defined(__BIG_ENDIAN))
 #define WTF_CPU_BIG_ENDIAN 1
 
 #elif !defined(__ARM_EABI__) \
@@ -563,11 +563,6 @@
 #define _INC_ASSERT    /* disable "assert.h" */
 #define assert(x)
 
-/* _countof is only included in CE6; for CE5 we need to define it ourself */
-#ifndef _countof
-#define _countof(x) (sizeof(x) / sizeof((x)[0]))
-#endif
-
 #endif  /* OS(WINCE) && !PLATFORM(QT) */
 
 #if PLATFORM(QT)
@@ -1079,6 +1074,7 @@
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 0
 #endif
+<<<<<<< HEAD
 
 /* Accelerated compositing */
 #if !defined(BUILDING_ON_TIGER)
@@ -1096,17 +1092,13 @@
 
 #if PLATFORM(QT)
 #define WTF_USE_ACCELERATED_COMPOSITING 1
+=======
+>>>>>>> webkit.org at r70949
 #endif
 
-/* FIXME: Defining ENABLE_3D_RENDERING here isn't really right, but it's always used with
-   with WTF_USE_ACCELERATED_COMPOSITING, and it allows the feature to be turned on and
-   off in one place. */
-#if PLATFORM(WIN) && !OS(WINCE)
-#include "QuartzCorePresent.h"
-#if QUARTZCORE_PRESENT
+/* Accelerated compositing */
+#if (PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)) || PLATFORM(IOS) || PLATFORM(QT) || (PLATFORM(WIN) && !OS(WINCE) &&!defined(WIN_CAIRO))
 #define WTF_USE_ACCELERATED_COMPOSITING 1
-#define ENABLE_3D_RENDERING 1
-#endif
 #endif
 
 #if (PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)) || PLATFORM(IOS)
diff --git a/JavaScriptCore/wtf/PlatformRefPtr.h b/JavaScriptCore/wtf/PlatformRefPtr.h
index 8ac16cb..f99ec9b 100644
--- a/JavaScriptCore/wtf/PlatformRefPtr.h
+++ b/JavaScriptCore/wtf/PlatformRefPtr.h
@@ -62,7 +62,8 @@ public:
 
     ~PlatformRefPtr()
     {
-        if (T* ptr = m_ptr)
+        T* ptr = m_ptr;
+        if (ptr && ptr != hashTableDeletedValue())
             derefPlatformPtr(ptr);
     }
 
@@ -70,7 +71,7 @@ public:
     {
         T* ptr = m_ptr;
         m_ptr = 0;
-        if (ptr)
+        if (ptr && ptr != hashTableDeletedValue())
             derefPlatformPtr(ptr);
     }
 
@@ -110,7 +111,7 @@ template <typename T> inline PlatformRefPtr<T>& PlatformRefPtr<T>::operator=(con
         refPlatformPtr(optr);
     T* ptr = m_ptr;
     m_ptr = optr;
-    if (ptr)
+    if (ptr && ptr != hashTableDeletedValue())
         derefPlatformPtr(ptr);
     return *this;
 }
@@ -121,7 +122,7 @@ template <typename T> inline PlatformRefPtr<T>& PlatformRefPtr<T>::operator=(T*
     if (optr)
         refPlatformPtr(optr);
     m_ptr = optr;
-    if (ptr)
+    if (ptr && ptr != hashTableDeletedValue())
         derefPlatformPtr(ptr);
     return *this;
 }
diff --git a/JavaScriptCore/wtf/StdLibExtras.h b/JavaScriptCore/wtf/StdLibExtras.h
index d594c17..fd7ada2 100644
--- a/JavaScriptCore/wtf/StdLibExtras.h
+++ b/JavaScriptCore/wtf/StdLibExtras.h
@@ -87,29 +87,33 @@ TypePtr reinterpret_cast_ptr(const void* ptr)
 
 namespace WTF {
 
-    /*
-     * C++'s idea of a reinterpret_cast lacks sufficient cojones.
-     */
-    template<typename TO, typename FROM>
-    TO bitwise_cast(FROM from)
-    {
-        COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_bitwise_cast_sizeof_casted_types_is_equal);
-        union {
-            FROM from;
-            TO to;
-        } u;
-        u.from = from;
-        return u.to;
-    }
+/*
+ * C++'s idea of a reinterpret_cast lacks sufficient cojones.
+ */
+template<typename TO, typename FROM>
+inline TO bitwise_cast(FROM from)
+{
+    COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_bitwise_cast_sizeof_casted_types_is_equal);
+    union {
+        FROM from;
+        TO to;
+    } u;
+    u.from = from;
+    return u.to;
+}
 
-    // Returns a count of the number of bits set in 'bits'.
-    inline size_t bitCount(unsigned bits)
-    {
-        bits = bits - ((bits >> 1) & 0x55555555);
-        bits = (bits & 0x33333333) + ((bits >> 2) & 0x33333333);
-        return (((bits + (bits >> 4)) & 0xF0F0F0F) * 0x1010101) >> 24;
-    }
+// Returns a count of the number of bits set in 'bits'.
+inline size_t bitCount(unsigned bits)
+{
+    bits = bits - ((bits >> 1) & 0x55555555);
+    bits = (bits & 0x33333333) + ((bits >> 2) & 0x33333333);
+    return (((bits + (bits >> 4)) & 0xF0F0F0F) * 0x1010101) >> 24;
+}
+
+// Macro that returns a compile time constant with the length of an array, but gives an error if passed a non-array.
+template<typename T, size_t Size> char (&ArrayLengthHelperFunction(T (&)[Size]))[Size];
+#define WTF_ARRAY_LENGTH(array) sizeof(::WTF::ArrayLengthHelperFunction(array))
 
 } // namespace WTF
 
-#endif
+#endif // WTF_StdLibExtras_h
diff --git a/JavaScriptCore/wtf/gobject/GTypedefs.h b/JavaScriptCore/wtf/gobject/GTypedefs.h
index b1600c2..76d1b1a 100644
--- a/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -38,6 +38,7 @@ typedef void* gpointer;
 
 typedef struct _GAsyncResult GAsyncResult;
 typedef struct _GCancellable GCancellable;
+typedef struct _GCharsetConverter GCharsetConverter;
 typedef struct _GCond GCond;
 typedef struct _GDir GDir;
 typedef struct _GdkAtom* GdkAtom;
diff --git a/JavaScriptCore/wtf/text/WTFString.h b/JavaScriptCore/wtf/text/WTFString.h
index 8a4a6c7..e9d6ae4 100644
--- a/JavaScriptCore/wtf/text/WTFString.h
+++ b/JavaScriptCore/wtf/text/WTFString.h
@@ -50,6 +50,14 @@ class wxString;
 class BString;
 #endif
 
+#if PLATFORM(BREWMP)
+// AECHAR is defined in AEEStdDef.h, but don't include it here to avoid conflicts.
+#ifndef _AECHAR_DEFINED
+typedef uint16             AECHAR;
+#define _AECHAR_DEFINED
+#endif
+#endif
+
 namespace WTF {
 
 class CString;
@@ -297,6 +305,10 @@ public:
     operator BString() const;
 #endif
 
+#if PLATFORM(BREWMP)
+    String(const AECHAR*);
+#endif
+
     static String fromUTF8(const char*, size_t);
     static String fromUTF8(const char*);
 
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
index 33f3c89..ec96636 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -591,13 +591,6 @@ public:
         unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
         context->restoreOutput(output, firstSubpatternId, count);
     }
-    void resetAssertionMatches(ByteTerm& term)
-    {
-        unsigned firstSubpatternId = term.atom.subpatternId;
-        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
-        for (unsigned i = 0; i < (count << 1); ++i)
-            output[(firstSubpatternId << 1) + i] = -1;
-    }
     bool parenthesesDoBacktrack(ByteTerm& term, BackTrackInfoParentheses* backTrack)
     {
         while (backTrack->matchAmount) {