Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

216 files changed, 7909 insertions, 11989 deletions

diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index 83442b2..f47d0b1 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -54,11 +54,11 @@ struct JSCallbackObjectData {
         return m_privateProperties->getPrivateProperty(propertyName);
     }
     
-    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    void setPrivateProperty(JSGlobalData& globalData, JSCell* owner, const Identifier& propertyName, JSValue value)
     {
         if (!m_privateProperties)
             m_privateProperties = adoptPtr(new JSPrivatePropertyMap);
-        m_privateProperties->setPrivateProperty(propertyName, value);
+        m_privateProperties->setPrivateProperty(globalData, owner, propertyName, value);
     }
     
     void deletePrivateProperty(const Identifier& propertyName)
@@ -83,12 +83,13 @@ struct JSCallbackObjectData {
             PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.impl());
             if (location == m_propertyMap.end())
                 return JSValue();
-            return location->second;
+            return location->second.get();
         }
         
-        void setPrivateProperty(const Identifier& propertyName, JSValue value)
+        void setPrivateProperty(JSGlobalData& globalData, JSCell* owner, const Identifier& propertyName, JSValue value)
         {
-            m_propertyMap.set(propertyName.impl(), value);
+            WriteBarrier<Unknown> empty;
+            m_propertyMap.add(propertyName.impl(), empty).first->second.set(globalData, owner, value);
         }
         
         void deletePrivateProperty(const Identifier& propertyName)
@@ -100,12 +101,12 @@ struct JSCallbackObjectData {
         {
             for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
                 if (ptr->second)
-                    markStack.append(ptr->second);
+                    markStack.append(&ptr->second);
             }
         }
 
     private:
-        typedef HashMap<RefPtr<StringImpl>, JSValue, IdentifierRepHash> PrivatePropertyMap;
+        typedef HashMap<RefPtr<StringImpl>, WriteBarrier<Unknown>, IdentifierRepHash> PrivatePropertyMap;
         PrivatePropertyMap m_propertyMap;
     };
     OwnPtr<JSPrivatePropertyMap> m_privateProperties;
@@ -137,9 +138,9 @@ public:
         return m_callbackObjectData->getPrivateProperty(propertyName);
     }
     
-    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    void setPrivateProperty(JSGlobalData& globalData, const Identifier& propertyName, JSValue value)
     {
-        m_callbackObjectData->setPrivateProperty(propertyName, value);
+        m_callbackObjectData->setPrivateProperty(globalData, this, propertyName, value);
     }
     
     void deletePrivateProperty(const Identifier& propertyName)
@@ -154,7 +155,6 @@ private:
     virtual UString className() const;
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     
     virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
index de5d842..59373ec 100644
--- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -164,12 +164,6 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-template <class Base>
 bool JSCallbackObject<Base>::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     PropertySlot slot;
@@ -238,7 +232,7 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
             if (StaticFunctionEntry* entry = staticFunctions->get(propertyName.impl())) {
                 if (entry->attributes & kJSPropertyAttributeReadOnly)
                     return;
-                JSCallbackObject<Base>::putDirect(propertyName, value); // put as override property
+                JSCallbackObject<Base>::putDirect(exec->globalData(), propertyName, value); // put as override property
                 return;
             }
         }
@@ -565,7 +559,7 @@ JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, JSValue sl
                 if (JSObjectCallAsFunctionCallback callAsFunction = entry->callAsFunction) {
                     
                     JSObject* o = new (exec) JSCallbackFunction(exec, asGlobalObject(thisObj->getAnonymousValue(0)), callAsFunction, propertyName);
-                    thisObj->putDirect(propertyName, o, entry->attributes);
+                    thisObj->putDirect(exec->globalData(), propertyName, o, entry->attributes);
                     return o;
                 }
             }
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index d6de426..d3c1993 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -108,7 +108,7 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
         jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
 
     JSCallbackConstructor* constructor = new (exec) JSCallbackConstructor(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
-    constructor->putDirect(exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
+    constructor->putDirect(exec->globalData(), exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
     return toRef(constructor);
 }
 
@@ -385,11 +385,11 @@ bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRe
     JSValue jsValue = value ? toJS(exec, value) : JSValue();
     Identifier name(propertyName->identifier(&exec->globalData()));
     if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
-        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue);
         return true;
     }
     if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info)) {
-        static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue);
         return true;
     }
     return false;
diff --git a/Source/JavaScriptCore/API/JSStringRefCF.cpp b/Source/JavaScriptCore/API/JSStringRefCF.cpp
index e0961d0..0877a13 100644
--- a/Source/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/Source/JavaScriptCore/API/JSStringRefCF.cpp
@@ -42,7 +42,7 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
     // it can hold.  (<rdar://problem/6806478>)
     size_t length = CFStringGetLength(string);
     if (length) {
-        OwnArrayPtr<UniChar> buffer(new UniChar[length]);
+        OwnArrayPtr<UniChar> buffer = adoptArrayPtr(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
         COMPILE_ASSERT(sizeof(UniChar) == sizeof(UChar), unichar_and_uchar_must_be_same_size);
         return OpaqueJSString::create(reinterpret_cast<UChar*>(buffer.get()), length).leakRef();
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h b/Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h
index 64e1f4d..f7b91da 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h
@@ -37,7 +37,7 @@ class JSObject;
 
 typedef void (*JSWeakMapDestroyedCallback)(struct OpaqueJSWeakObjectMap*, void*);
 
-typedef JSC::WeakGCMap<void*, JSC::JSObject*> WeakMapType;
+typedef JSC::WeakGCMap<void*, JSC::JSObject> WeakMapType;
 
 struct OpaqueJSWeakObjectMap : public RefCounted<OpaqueJSWeakObjectMap> {
 public:
diff --git a/Source/JavaScriptCore/Android.mk b/Source/JavaScriptCore/Android.mk
index 052af2c..269d298 100644
--- a/Source/JavaScriptCore/Android.mk
+++ b/Source/JavaScriptCore/Android.mk
@@ -65,12 +65,6 @@ LOCAL_SRC_FILES := \
 	parser/Parser.cpp \
 	parser/ParserArena.cpp \
 	\
-	pcre/pcre_compile.cpp \
-	pcre/pcre_exec.cpp \
-	pcre/pcre_tables.cpp \
-	pcre/pcre_ucp_searchfuncs.cpp \
-	pcre/pcre_xclass.cpp \
-	\
 	profiler/Profile.cpp \
 	profiler/ProfileGenerator.cpp \
 	profiler/ProfileNode.cpp \
@@ -84,6 +78,7 @@ LOCAL_SRC_FILES := \
 	runtime/BooleanObject.cpp \
 	runtime/BooleanPrototype.cpp \
 	runtime/CallData.cpp \
+	runtime/MarkedBlock.cpp \
 	runtime/MarkedSpace.cpp \
 	runtime/Heap.cpp \
 	runtime/CommonIdentifiers.cpp \
@@ -133,6 +128,7 @@ LOCAL_SRC_FILES := \
 	runtime/LiteralParser.cpp \
 	runtime/Lookup.cpp \
 	runtime/MachineStackMarker.cpp \
+	runtime/ConservativeSet.cpp \
 	runtime/MarkStack.cpp \
 	runtime/MarkStackPosix.cpp \
 	runtime/MathObject.cpp \
@@ -168,6 +164,7 @@ LOCAL_SRC_FILES := \
 	\
 	wtf/Assertions.cpp \
 	wtf/ByteArray.cpp \
+	wtf/CryptographicallyRandomNumber.cpp \
 	wtf/CurrentTime.cpp \
 	wtf/DateMath.cpp \
 	wtf/DecimalNumber.cpp \
@@ -175,7 +172,11 @@ LOCAL_SRC_FILES := \
 	wtf/HashTable.cpp \
 	wtf/MD5.cpp \
 	wtf/MainThread.cpp \
+<<<<<<< HEAD
 	wtf/OSAllocatorPosix.cpp \
+=======
+	wtf/OSRandomSource.cpp \
+>>>>>>> webkit.org at r78450
 	wtf/PageAllocationAligned.cpp\
 	wtf/PageBlock.cpp\
 	wtf/RandomNumber.cpp \
@@ -237,6 +238,7 @@ $(LEXER_HEADER): $(LOCAL_PATH)/create_hash_table
 $(LEXER_HEADER): $(intermediates)/%.lut.h : $(LOCAL_PATH)/parser/Keywords.table
 	$(transform-generated-source)
 
+<<<<<<< HEAD
 CHARTABLES := $(intermediates)/chartables.c
 $(CHARTABLES): PRIVATE_PATH := $(LOCAL_PATH)
 $(CHARTABLES): PRIVATE_CUSTOM_TOOL = perl $(PRIVATE_PATH)/pcre/dftables $@
@@ -251,3 +253,6 @@ $(REGEXP_JIT_TABLES): $(LOCAL_PATH)/create_regex_tables
 	$(transform-generated-source)
 
 LOCAL_GENERATED_SOURCES += $(JSC_OBJECTS) $(LEXER_HEADER) $(CHARTABLES) $(REGEXP_JIT_TABLES)
+=======
+LOCAL_GENERATED_SOURCES += $(JSC_OBJECTS) $(LEXER_HEADER)
+>>>>>>> webkit.org at r78450
diff --git a/Source/JavaScriptCore/Android.v8.wtf.mk b/Source/JavaScriptCore/Android.v8.wtf.mk
index 340ed90..11df0fa 100644
--- a/Source/JavaScriptCore/Android.v8.wtf.mk
+++ b/Source/JavaScriptCore/Android.v8.wtf.mk
@@ -26,14 +26,9 @@
 # wtf source files
 
 LOCAL_SRC_FILES := \
-	pcre/pcre_compile.cpp \
-	pcre/pcre_exec.cpp \
-	pcre/pcre_tables.cpp \
-	pcre/pcre_ucp_searchfuncs.cpp \
-	pcre/pcre_xclass.cpp \
-	\
 	wtf/Assertions.cpp \
 	wtf/ByteArray.cpp \
+	wtf/CryptographicallyRandomNumber.cpp \
 	wtf/CurrentTime.cpp \
 	wtf/DateMath.cpp \
 	wtf/DecimalNumber.cpp \
@@ -41,9 +36,13 @@ LOCAL_SRC_FILES := \
 	wtf/HashTable.cpp \
 	wtf/MD5.cpp \
 	wtf/MainThread.cpp \
+<<<<<<< HEAD
 	wtf/OSAllocatorPosix.cpp \
 	wtf/PageAllocationAligned.cpp \
 	wtf/PageBlock.cpp \
+=======
+	wtf/OSRandomSource.cpp \
+>>>>>>> webkit.org at r78450
 	wtf/RandomNumber.cpp \
 	wtf/RefCountedLeakCounter.cpp \
 	wtf/StackBounds.cpp \
@@ -68,6 +67,7 @@ LOCAL_SRC_FILES := \
 	wtf/unicode/CollatorDefault.cpp \
 	wtf/unicode/UTF8.cpp \
 	\
+<<<<<<< HEAD
 	wtf/unicode/icu/CollatorICU.cpp \
 	\
 	wtf/url/src/URLCharacterTypes.cpp \
@@ -85,3 +85,6 @@ $(intermediates)/pcre/pcre_tables.o : $(CHARTABLES)
 
 # We do not add $(CHARTABLES) to LOCAL_GENERATED_SOURCES because the chartables.c file
 # is explicitly #included in pcre_tables.cpp.
+=======
+	wtf/unicode/icu/CollatorICU.cpp
+>>>>>>> webkit.org at r78450
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 674d272..f18826e 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -10,7 +10,6 @@ SET(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
     "${JAVASCRIPTCORE_DIR}/parser"
-    "${JAVASCRIPTCORE_DIR}/pcre"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
     "${JAVASCRIPTCORE_DIR}/yarr"
@@ -67,12 +66,7 @@ SET(JavaScriptCore_SOURCES
     parser/Nodes.cpp
     parser/Parser.cpp
     parser/ParserArena.cpp
-
-    pcre/pcre_compile.cpp
-    pcre/pcre_exec.cpp
-    pcre/pcre_tables.cpp
-    pcre/pcre_ucp_searchfuncs.cpp
-    pcre/pcre_xclass.cpp
+    parser/SourceProviderCache.cpp
 
     profiler/Profile.cpp
     profiler/ProfileGenerator.cpp
@@ -87,6 +81,7 @@ SET(JavaScriptCore_SOURCES
     runtime/BooleanObject.cpp
     runtime/BooleanPrototype.cpp
     runtime/CallData.cpp
+    runtime/MarkedBlock.cpp
     runtime/MarkedSpace.cpp
     runtime/Heap.cpp
     runtime/CommonIdentifiers.cpp
@@ -137,6 +132,7 @@ SET(JavaScriptCore_SOURCES
     runtime/LiteralParser.cpp
     runtime/Lookup.cpp
     runtime/MachineStackMarker.cpp
+    runtime/ConservativeSet.cpp
     runtime/MarkStack.cpp
     runtime/MathObject.cpp
     runtime/NativeErrorConstructor.cpp
@@ -208,15 +204,6 @@ ENDFOREACH ()
 GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
 LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/Lexer.lut.h)
 
-# GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
-ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/chartables.c
-    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/pcre/dftables
-    COMMAND ${PERL_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/pcre/dftables --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_DIR}/chartables.c
-    VERBATIM)
-ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/pcre/pcre_tables.cpp ${DERIVED_SOURCES_DIR}/chartables.c)
-
-
 #GENERATOR: "RegExpJitTables.h": tables used by Yarr
 ADD_CUSTOM_COMMAND(
     OUTPUT ${DERIVED_SOURCES_DIR}/RegExpJitTables.h
diff --git a/Source/JavaScriptCore/CMakeListsWinCE.txt b/Source/JavaScriptCore/CMakeListsWinCE.txt
index 666b1c7..58a535e 100644
--- a/Source/JavaScriptCore/CMakeListsWinCE.txt
+++ b/Source/JavaScriptCore/CMakeListsWinCE.txt
@@ -3,3 +3,20 @@ LIST(APPEND JavaScriptCore_SOURCES
 
     runtime/MarkStackWin.cpp
 )
+
+IF (ENABLE_JIT AND WTF_CPU_ARM)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.asm
+        MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/create_jit_stubs
+        DEPENDS ${JAVASCRIPTCORE_DIR}/jit/JITStubs.cpp
+        COMMAND ${PERL_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/create_jit_stubs --prefix=MSVC ${JAVASCRIPTCORE_DIR}/jit/JITStubs.cpp > ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.asm
+        VERBATIM)
+
+    ADD_CUSTOM_COMMAND(
+        OUTPUT ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.obj
+        MAIN_DEPENDENCY ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.asm
+        COMMAND armasm -nologo ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.asm ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.obj
+        VERBATIM)
+
+    LIST (APPEND JavaScriptCore_SOURCES ${DERIVED_SOURCES_DIR}/GeneratedJITStubs.obj)
+ENDIF ()
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index a5391bf..12e0cfd 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,4130 @@
+2011-02-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a compile-time option to completely disable WebArchive support.
+        https://bugs.webkit.org/show_bug.cgi?id=52712
+
+        Add an ENABLE(WEB_ARCHIVE) compile-time setting and use it for all WebArchive code.
+        Ports Affected:
+            WebArchive support is currently enabled for all ports that define PLATFORM(CF) apart from Qt.
+            This patch preserves this behavior except that it also disables support in the Chromium port.
+
+        * wtf/Platform.h: Add ENABLE_WEB_ARCHIVE definition and turn it off explicitly for Qt & Chromium ports.
+
+2011-02-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 53760 - JSC fails to build with TOT Clang
+        https://bugs.webkit.org/show_bug.cgi?id=53760
+
+        Fix -Woverloaded-virtual warnings. This is also a 6% speedup on the v8 raytrace
+        benchmark; it is nothing-to-noise on everything else.
+
+        * API/JSCallbackObject.h: Remove pointlessly overloaded method.
+        * API/JSCallbackObjectFunctions.h: Ditto.
+        * runtime/Arguments.cpp: 
+        (JSC::Arguments::put): Change signature to match the base class. This implementation
+        was no longer being called by anyone. This wasn't noticed because it is merely an
+        optimization of the base class' implementation.
+        * runtime/Arguments.h: Ditto.
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Use /dev/urandom as the OSRandomSource on OS(DARWIN)
+        https://bugs.webkit.org/show_bug.cgi?id=54279
+
+        I'm not sure it makes much of a difference whether we use arc4random or
+        /dev/urandom on Mac.  However, there's some aesthetic benefit to using
+        the same underlying API on as many platforms as reasonable.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        Enable ArrayBuffers by default
+        https://bugs.webkit.org/show_bug.cgi?id=54310
+
+        Export the required functions.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove explicit disable ENABLE_ASSEMBLER_WX_EXCLUSIVE on non-iOS ports
+        https://bugs.webkit.org/show_bug.cgi?id=54107
+        
+        It is unnecessary to explicitly disable ENABLE_ASSEMBLER_WX_EXCLUSIVE
+        by the definition of ENABLE().
+
+        * wtf/Platform.h:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Randomly touch some build files in the hopes of fixing the Qt build.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+        
+        (Rolling back in r78386 with the build fixed.)
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Used svn merge -r78386:78385 to roll out r78386 because it broke the build.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build: added an exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for the heap: Removed CollectorHeapIterator
+        https://bugs.webkit.org/show_bug.cgi?id=54298
+        
+        CollectorHeapIterator is a God object that knows the internals of each
+        of the pieces of the heap. This undermines the encapsulation I'm trying
+        to achieve by splitting concepts into different classes.
+        
+        As an alternative, I've given each class a forEach iteration function,
+        which takes a functor as an argument. Now, each class just needs to
+        know how to iterate the things it knows about.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed CollectorHeapIterator.
+
+        * debugger/Debugger.cpp:
+        (JSC::Recompiler::Recompiler):
+        (JSC::Recompiler::~Recompiler):
+        (JSC::Recompiler::operator()):
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use forEach interface
+        instead of an iterator.
+
+        * runtime/CollectorHeapIterator.h: Removed.
+
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::TypeCounter):
+        (JSC::TypeCounter::typeName):
+        (JSC::TypeCounter::operator()):
+        (JSC::TypeCounter::take):
+        (JSC::Heap::protectedObjectTypeCounts):
+        (JSC::Heap::objectTypeCounts): Added forEach and removed iterator.
+
+        * runtime/Heap.h:
+        (JSC::Heap::forEach):
+        * runtime/JSGlobalData.cpp:
+        (JSC::Recompiler::operator()):
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::forEach): Added forEach. Removed friend declaration
+        for CollectorHeapIterator. Now, we can make all our data private and
+        change it without breaking any other classes.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::forEach): Added forEach and removed iterator.
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        CryptographicRandomNumber has its threading ifdefs backwards
+        https://bugs.webkit.org/show_bug.cgi?id=54280
+
+        Turns out we want the mutex when thread is enabled.  :)
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+
+2011-02-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit should have a cryptographic RNG
+        https://bugs.webkit.org/show_bug.cgi?id=22049
+
+        Teach JavaScriptCore how to export this function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made all constants private
+        so clients don't know whether allocations are fixed-sized or not
+        https://bugs.webkit.org/show_bug.cgi?id=54270
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance): Updated for removal of HeapConstants.
+
+        * runtime/Error.cpp: Switched to using ASSERT_CLASS_FITS_IN_CELL, like
+        all other classes.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate): Updated for removal of HeapConstants.
+        (JSC::Heap::reset): Updated to use size(), instead of calculating size
+        on our own.
+
+        * runtime/Heap.h: Moved the ASSERT here to MarkedBlock, since it enforces
+        on special knowledge of fixed-sizery, which only MarkedBlock is supposed
+        to know about.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Updated for removal of HeapConstants.
+        Also changed to reset nextCell to 0 at the end of a block, since that
+        seems more consistent.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Changed to use a fixed array of char.
+        This hard-coded size is a little wonky, but the compiler will tell us
+        if it's ever wrong, so I think it's OK.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep): Updated for removal of HeapConstants.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::capacity): Made constants private to this class.
+        Removed HeapConstants. Added size() and capacity() functions.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        * runtime/MarkedSpace.h: Use MarkedBlock helper functions instead of
+        direct knowledge of MarkedBlock internals.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made mark bits private
+        https://bugs.webkit.org/show_bug.cgi?id=54264
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Renamed clearMarkBits => clearMarks, since clients
+        don't need to know that marks are represented as bits. Renamed
+        markedCells => markCount, since clients don't need to know that blocks
+        are split into cells.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount): New helper functions for encapsulating
+        the information clients actually need.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::markCount):
+        (JSC::MarkedSpace::objectCount):
+        * runtime/MarkedSpace.h: Use new helper functions instead of accessing
+        MarkedBlock data directly.
+
+2011-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cached JavaScript Parser Data Being Left in Memory Cache
+        https://bugs.webkit.org/show_bug.cgi?id=54245
+
+        Added clear method which removes SourceProviderCache items.
+        Cleaned up extraneous whitespace.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::clear):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Follow-up fix to r78291. I should pass (int) 0, not '0' to memset. 
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::commonConstructor): fix mistaken post-review change.
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make DefaultGCActivityCallback for PLATFORM(CF) Easier to Subclass
+        https://bugs.webkit.org/show_bug.cgi?id=54257
+
+        A subclass may want to specify the CFRunLoop that the Garbage Collection
+        will happen on. It was difficult to manipulate this in a subclass because
+        the current DefaultGCActivityCallback class does this in its constructor.
+        This patch generalizes things a bit more so that a specific run loop can
+        be passed in to the constructor. This makes it so all run loop management
+        can stay in DefaultGCActivityCallback and a subclass can specify any runloop.
+
+        * runtime/GCActivityCallback.h: expose a PLATFORM(CF) constructor that can
+        specify the runloop GC can be scheduled on.
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): two constructors,
+        one that specifies the run loop and passes that on to commonConstructor and
+        the old constructor defaults to the current run loop.
+        (JSC::DefaultGCActivityCallback::commonConstructor): do normal construction,
+        adding the timer to the given runloop.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Moved allocate() and sweep() into MarkedBlock
+        https://bugs.webkit.org/show_bug.cgi?id=54253
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h: Removed DeadObjectIterator, since it
+        is now unused.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Moved the call to shrink() here, since it seems a
+        little more clear for MarkedSpace's client to tell it explicitly when to
+        shrink.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Split out from MarkedSpace::allocate.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Split out from MarkedSpace::sweep, and
+        converted to more directly iterate a MarkedBlock based on knowing its
+        internal structure.
+
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Split out the code mentioned above.
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix compilation error on OpenBSD
+        https://bugs.webkit.org/show_bug.cgi?id=53766
+
+        Add a HAVE_STRNSTR in Platform.h and define it only on Darwin and FreeBSD.
+
+        * wtf/Platform.h:
+        * wtf/StringExtras.h: Use HAVE(STRNSTR) now.
+
+2011-02-10  Adam Roben  <aroben@apple.com>
+
+        Print locations of assertions and logs in a way that Visual Studio understands
+
+        With this change, double-clicking one of these locations in Visual Studio's Output Window
+        will focus that line of code in the editor.
+
+        Fixes <http://webkit.org/b/54208> Double-clicking locations of assertions/logs in Visual
+        Studio's Output Window does nothing
+
+        Reviewed by Alexey Proskuryakov.
+
+        * wtf/Assertions.cpp:
+        (printCallSite): Use OS(WINDOWS) instead of the meaningless OS(WIN). When we aren't using
+        the debug CRT (and thus can't call _CrtDbgReport), print the file and line number using the
+        same format that cl.exe uses when it prints compiler errors.
+
+2011-02-10  Dan Bernstein  <mitz@apple.com>
+
+        LLVM Compiler build fix.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+
+2011-02-10  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove PCRE source from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=54188
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/AUTHORS: Removed.
+        * pcre/COPYING: Removed.
+        * pcre/dftables: Removed.
+        * pcre/pcre.h: Removed.
+        * pcre/pcre.pri: Removed.
+        * pcre/pcre_compile.cpp: Removed.
+        * pcre/pcre_exec.cpp: Removed.
+        * pcre/pcre_internal.h: Removed.
+        * pcre/pcre_tables.cpp: Removed.
+        * pcre/pcre_ucp_searchfuncs.cpp: Removed.
+        * pcre/pcre_xclass.cpp: Removed.
+        * pcre/ucpinternal.h: Removed.
+        * pcre/ucptable.cpp: Removed.
+        * wscript:
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add randomValuesFromOS for OS(WINDOWS)
+        https://bugs.webkit.org/show_bug.cgi?id=54155
+
+        Use CryptGenRandom for generating cryptographically secure random numbers.
+        This will work on WinCE and MinGW too.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(r78149): Return value of read() shouldn't be ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=54167
+        
+        stdio read should have its return value handled. Build error in gcc 4.4.5.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename randomValuesFromOS to cryptographicallyRandomValuesFromOS
+        https://bugs.webkit.org/show_bug.cgi?id=54156
+
+        randomValuesFromOS generates random numbers of cryptographic quality.
+        Make this clear by adding "cryptographically" to the function name.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::stir):
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+        * wtf/OSRandomSource.h:
+
+2011-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8805364> Malloc zone enumeration code should be safe in the face of errors from the memory reader.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::recordAdministrativeRegions): Use the new helper function to walk the linked list safely.
+        (WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMallocStats::PageMapFreeObjectFinder::visit): Bail out if the span could not be read.
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit): Ditto.
+        * wtf/MallocZoneSupport.h:
+        (WTF::RemoteMemoryReader::operator()): Remove an assert that is not valid.
+        (WTF::RemoteMemoryReader::nextEntryInLinkedList): Add a helper function for retrieving the next entry in
+        a linked list. It maps a failed read of the remote memory in to a null pointer, which all callers can
+        handle gracefully.
+
+2011-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54164 - Optimize global_var accesses on JSVALUE64
+
+        Directly embed the pointer to d->registers, optimize out the load
+        from the variable object, as we do already in JSVALUE32_64.
+
+        This is a ~1.5% win on sunspidey.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Made MarkedBlock responsible
+        for its own initialization and destruction
+        https://bugs.webkit.org/show_bug.cgi?id=54137
+
+        * runtime/CollectorHeapIterator.h: Removed ObjectIterator since it is
+        now unused.
+
+        * runtime/JSCell.h: Maded MarkedBlock a friend so it can construct and
+        destruct JSCells.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock): Migrated initialization and destruction
+        code from MarkedSpace, updating it not to use ObjectIterator. We don't
+        want to use an abstract iterator since iteration will be unique to each
+        block in the future.
+
+        * runtime/MarkedBlock.h: Made the consructor private and moved it into
+        the .cpp file because it's big now.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): Migrated code.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock): Keep a vector of MarkedBlock
+        pointers instead of aligned allocations -- how MarkedBlocks are allocated
+        is now an implementation detail of MarkedBlock.
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Another attempt to fix the Qt Windows build.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt Windows build.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTF::cryptographicallyRandomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=54083
+
+        Introduce a cryptographically strong random number generator to WTF.
+        The random number generator is based on arc4random as found in:
+
+        http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/arc4random.c?rev=1.22
+
+        I've changed to source to WebKit style and abstracted the operating
+        system interaction to OSRandomSource.  We'll use this functionality to
+        expose a cryptographically strong random number generator to
+        JavaScript.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CryptographicallyRandomNumber.cpp: Added.
+        (WTF::initMutexIfNeeded):
+        (WTF::init):
+        (WTF::addRandomData):
+        (WTF::stir):
+        (WTF::stirIfNeeded):
+        (WTF::getByte):
+        (WTF::getWord):
+        (WTF::cryptographicallyRandomNumber):
+        (WTF::cryptographicallyRandomValues):
+        * wtf/CryptographicallyRandomNumber.h: Added.
+        * wtf/OSRandomSource.cpp: Added.
+        (WTF::randomValuesFromOS):
+        * wtf/OSRandomSource.h: Added.
+        * wtf/wtf.pri:
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the build.
+
+        * wtf/Bitmap.h: Include string.h for memset. Not sure why this started
+        failing now.
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A tiny bit of encapsulation for MarkedBlock: made its heap data member private
+        https://bugs.webkit.org/show_bug.cgi?id=54129
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::heap): Made the heap data member private, and provided
+        a constructor and an accessor.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::heap): Use the constructor and accessor.
+
+2011-02-09  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=54064
+
+        * runtime/MarkedSpace.cpp: Removed some now-unused constants and
+        declarations.
+
+        (JSC::MarkedSpace::allocate): Removed some ASSERTs that are also ASSERTed
+        by our caller. Removed redundant typedefs.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use a vector to track blocks in the Heap, instead of hand-rolled vector-like code
+        https://bugs.webkit.org/show_bug.cgi?id=54062
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive): Updated for new mark invariant: To
+        know if an object is live, you just need to test its mark bit.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace): Moved waterMark and highWaterMark from
+        CollectorHeap into MarkedSpace, since they're global state. Removed call
+        to memset since CollectorHeap is a true class with its own constructor now.
+
+        (JSC::MarkedSpace::destroy): Change uses of m_heap.usedBlocks to
+        m_heap.blocks.size(), and m_heap.numBlocks to m_heap.blocks.capacity().
+
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): No need to manage our vector manually anymore.
+
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarkBits):
+        (JSC::MarkedSpace::markedCells):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::reset):
+        (JSC::MarkedSpace::primaryHeapEnd):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+        (JSC::MarkedSpace::contains): Same as above.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Give each MarkedBlock enough mark bits to cover the whole block
+        https://bugs.webkit.org/show_bug.cgi?id=54029
+        
+        SunSpider reports no change.
+
+        This simplifies access to mark bits, since any cell-aligned pointer
+        into a block now has a valid mark bit to test.
+        
+        * runtime/MarkedBlock.h: Changed CELLS_PER_BLOCK to account for the extra
+        mark bits. This happens not to change its actual value.
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked): Changed const JSCell* to const void* to
+        remove a cast from our caller, and to more accurately reflect the fact
+        that MarkedBlock is agnostic about the types pointed to by the pointers
+        you pass to it.
+
+        (JSC::MarkedBlock::isPossibleCell): Removed a null check. We now consider
+        the null pointer to be a possible cell with a 0 (impossible) block. This
+        removes a null check from marking.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Simplified the contains check, and inlined
+        the whole thing, now that it's so simple.
+
+2011-02-08  Daniel Bates  <dbates@rim.com>
+
+        Rubber-stamped by Martin Robinson.
+
+        Rename enum ProtectionSeting [sic] to ProtectionSetting.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocator.h:
+
+2011-02-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Should not always define USE_SYSTEM_MALLOC
+        https://bugs.webkit.org/show_bug.cgi?id=54007
+
+        * wtf/Platform.h:
+
+2011-02-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        LLVM Compiler build fix.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrier::WriteBarrier):
+
+2011-02-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSVariableObject::setRegisters should take PassOwnArrayPtr for registersArray.
+        https://bugs.webkit.org/show_bug.cgi?id=53902
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Uses OwnArrayPtr<Register> instead of Register*.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsFrom): Ditto.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::copyRegisterArray): Returns PassOwnArrayPtr<Register> instead of Register*.
+        (JSC::JSVariableObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53969
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Removed resizeBlocks and growBlocks, and
+        renamed shrinkBlocks to shrink, making it unconditionally shrink as
+        much as possible.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Simplified the marked space's mark invariant
+        https://bugs.webkit.org/show_bug.cgi?id=53968
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Mark objects when allocating them. This
+        means that, at all times other than the mark phase, an object is live
+        if and only if it is marked.
+
+        (JSC::MarkedSpace::containsSlowCase): Use the new mark invariant to
+        simplify testing whether an object is live.
+
+2011-02-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=53950
+        USE_WK_SCROLLBAR_PAINTER in ScrollbarThemeMac should be in
+        Platform.h instead
+
+        * wtf/Platform.h:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add built-in decoder for UTF-8 for improved performance
+        https://bugs.webkit.org/show_bug.cgi?id=53898
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Added U8_MAX_LENGTH and
+        U8_APPEND_UNSAFE. Also fixed header.
+
+2011-02-07  Adam Roben  <aroben@apple.com>
+
+        Delete precompiled headers whenever any .vsprops file changes
+
+        Precompiled headers need to be rebuilt if, e.g., an ENABLE_* macro is changed in one of our
+        .vsprops files. Unfortunately, Visual Studio isn't smart enough to figure this out, so we
+        give it some assistance by deleting the precompiled headers whenever any .vsprops file
+        changes.
+
+        I also made some drive-by fixes while I was in the area.
+
+        Fixes <http://webkit.org/b/53826> react-to-vsprops-changes.py doesn't force precompiled
+        headers to be rebuilt, but should
+
+        Reviewed by David Kilzer.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stop ignoring the
+        return code from react-to-vsprops-changes.py so we will notice when errors are introduced.
+        But skip the script entirely in production builds, where it is both unnecessary and can't
+        function correctly (due to not having the entire source tree available to it).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Removed an extra '*' in the glob for finding manifest files. The extra '*' was
+        leftover from before we rearranged WebKitBuild in r75138. Moved code to delete an old file
+        to the new delete_if_older_than function. Added code to delete any precompiled headers older
+        than the newest .vsprops file.
+        (delete_if_older_than): Added. Code came from main.
+
+2011-02-07  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        ASSERTS_DISABLED -> ASSERT_DISABLED
+
+        * wtf/BloomFilter.h:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed; speculative Qt build fix.
+
+        * JavaScriptCore.pro:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        OwnArraryPtr.h uses deleteOwnedPtr but doesn’t include OwnPtrCommon.h
+        https://bugs.webkit.org/show_bug.cgi?id=52867
+
+        Removed LOOSE_OWN_ARRAY_PTR and OwnArrayPtr<T>::set. Replaced all calls to OwnArrayPtr::set
+        and loose instantiation of OwnArrayPtr by calls to operator= and adoptArrayPtr. Also removed
+        OwnArrayPtrCommon.h since PassOwnArrayPtr.h needs to include OwnArrayPtr.h and there is
+        no point in putting deleteOwnedArrayPtr into a separate header.
+        
+        Note: if this patch breaks build, the code is either instiantiating OwnArrayPtr
+        without calling adoptArrayPtr or calling set on ArrayOwnPtr instead of operator=.
+
+        No tests are added since this is a refactoring.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Calls adoptArrayPtr.
+        * GNUmakefile.am: Removed OwnArrayPtrCommon.h
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deleteProperty): Calls adoptArrayPtr.
+        * runtime/Arguments.h:
+        (JSC::Arguments::copyRegisters): Ditto.
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Ditto.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::setRegisters): Calls operator= instead of set.
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain): Ditto.
+        * wtf/CMakeLists.txt:
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): No longer instnatiates OwnArrayPtr
+        with a null pointer.
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnArrayPtrCommon.h: Removed.
+        * wtf/PassOwnArrayPtr.h: No longer includes OwnArrayCommon.h
+        (WTF::deleteOwnedArrayPtr): Moved from OwnArrayPtrCommon.h
+
+2011-02-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use bloom filter for descendant selector filtering
+        https://bugs.webkit.org/show_bug.cgi?id=53880
+        
+        Implement a bloom filter with k=2 and 8 bit counting.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/BloomFilter.h: Added.
+        (WTF::BloomFilter::maximumCount):
+        (WTF::BloomFilter::BloomFilter):
+        (WTF::BloomFilter::mayContain):
+        (WTF::BloomFilter::add):
+        (WTF::BloomFilter::remove):
+        (WTF::BloomFilter::firstSlot):
+        (WTF::BloomFilter::secondSlot):
+        (WTF::::add):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::likelyEmpty):
+        (WTF::::isClear):
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in r77612 with ASSERT/crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        Don't shrink the heap to 0 unconditionally. Instead, shrink to 1 if
+        necessary. For now, the heap assumes that it always has at least one
+        block live.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrinkBlocks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: REALLY remove the last vestiges of JSVALUE32!
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        * DerivedSources.make: Removed dependency on
+        JavaScriptCore.JSVALUE32.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        Reviewed by Darin Adler.
+
+        Support for JSVALUE32 was originaly removed in r70111.
+
+        * Configurations/JavaScriptCore.xcconfig: Changed armv6 to use
+        JavaScriptCore.JSVALUE32_64.exp and ppc64 to use
+        JavaScriptCore.JSVALUE64.exp to match Platform.h.
+        * DerivedSources.make: Removed rule for
+        JavaScriptCore.JSVALUE32.exp.
+        * JavaScriptCore.JSVALUE32only.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to JavaScriptCore.JSVALUE32only.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Use static_cast and other style cleanup in YarrInterpreter.cpp
+        <http://webkit.org/b/53772>
+
+        Reviewed by John Sullivan.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readChecked): Use
+        static_cast.
+        (JSC::Yarr::Interpreter::InputStream::checkInput): Remove
+        unnecessary else block.
+        (JSC::Yarr::Interpreter::matchAssertionEOL): Ditto.
+        (JSC::Yarr::Interpreter::backtrackBackReference): Ditto.
+        (JSC::Yarr::ByteCompiler::emitDisjunction): Use static_cast.
+
+2011-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77625 and r77626.
+        http://trac.webkit.org/changeset/77625
+        http://trac.webkit.org/changeset/77626
+        https://bugs.webkit.org/show_bug.cgi?id=53765
+
+        It broke Windows builds (Requested by Ossy_ on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Removed.
+
+2011-02-04  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-02-04  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed rollout two patches r77614 and r77612.
+
+        REGRESSION: Snow Leopard Intel Release anumber of failing tests.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix 32bit build.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Use an explicit cast to avoid shortening warnings,
+        since 1.5 is double (64bit), and the result is size_t (32bit).
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Changed MarkedSpace to delegate grow/shrink decisions to Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        SunSpider reports no change.
+        
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Reorganized a few data members for better cache locality.
+        Added a grow policy.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset): Don't shrink automatically. Instead, wait for
+        the heap to make an explicit sweep call.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark): Use a watermark to determine how
+        many bytes to allocate before failing and giving the heap an opportunity
+        to collect garbage. This also means that we allocate blocks on demand,
+        instead of ahead of time.
+
+2011-02-03  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add navigator.registerProtocolHandler behind a flag.
+        https://bugs.webkit.org/show_bug.cgi?id=52609
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Not all blocks are freed when the heap is freed (counting is hard!)
+        https://bugs.webkit.org/show_bug.cgi?id=53732
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy): Freeing a block compacts the list, so just
+        keep freeing block 0 until there are no blocks left.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: The new MarkedBlock.h header
+        needs to be private, not project, so other projects can include headers
+        that depend on it.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start using MarkedBlock instead of CollectorBlock
+        https://bugs.webkit.org/show_bug.cgi?id=53693
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell): Updated for const-ness.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::containsSlowCase):
+        (JSC::MarkedSpace::clearMarkBits): Updated for const-ness.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock):
+        (JSC::MarkedSpace::heap):
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        (JSC::MarkedSpace::contains): Switched from CollectorBlock to MarkedBlock,
+        and deleted dead CollectorBlock-related code.
+
+2011-02-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        oops, build fix!
+
+        * wtf/Assertions.cpp:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 53650 - Add a BACKTRACE macro to Assertions.h
+
+        Add a BACKTRACE macro to Assertions.h, which will print a backtrace on
+        debug Mac builds, make CRASH (and thus ASSERT) automatically call this.
+
+        * JavaScriptCore.exp:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-02-02  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improper backtrack of nested non-capturing greedy paren to prior paren
+        https://bugs.webkit.org/show_bug.cgi?id=53261
+
+        A paren that follows a non-capturing greedy paren nested within a 
+        non-capturing fixed paren was back tracking to the last paren 
+        processed instead of the immediately prior paren.
+        Refactored default backtracking of parens to prior paren to work for
+        both nested (within) and immediately prior (after) parens.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+
+2011-02-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Add DerivedSources.make to some Visual Studio projects
+        https://bugs.webkit.org/show_bug.cgi?id=53607
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add DerivedSources.make.
+
+2011-02-02  Steve Lacey  <sjl@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Implement basic media statistics on media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=53322
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for wxWebKit.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more Heap refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53577
+        
+        SunSpider reports no change.
+        
+        Split out MarkedBlock into its own file / class.
+        
+        Did the following renames:
+            isCellMarked => isMarked
+            checkMarkCell => testAndSetMarked
+            markCell => setMarked
+            cellOffset => cellNumber
+            collectorBlock => blockFor
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Heap.cpp:
+        (JSC::WeakGCHandlePool::update):
+        * runtime/Heap.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::internalAppend):
+        * runtime/MarkedBlock.cpp: Added.
+        * runtime/MarkedBlock.h: Added.
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Fix windows clean build.
+
+        * DerivedSources.make:
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix dist compilation
+        https://bugs.webkit.org/show_bug.cgi?id=53579
+
+        * GNUmakefile.am: Added WriteBarrier.h to the sources, it was
+        added in r77151
+
+2011-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77297.
+        http://trac.webkit.org/changeset/77297
+        https://bugs.webkit.org/show_bug.cgi?id=53538
+
+        caused leopard crashes (Requested by paroga on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac production builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Try to fix the windows build.
+
+        * DerivedSources.make:
+
+2011-02-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Part 2 for <rdar://problem/8492788>
+        Adopt WKScrollbarPainterController
+
+        Use header detection to define scrollbar painting controller #define.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Refactor JSGlobalObject-related tear-down
+        https://bugs.webkit.org/show_bug.cgi?id=53478
+        
+        While investigating crashes caused by r77082, I noticed some strange
+        destructor-time behaviors. This patch makes them less strange.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock): Store the set of global code
+        blocks on the Heap, instead of on independent global objects. The heap
+        is guaranteed to outlast any GC-owned data structure. The heap is also
+        a natural place to store objects that needs out-of-band marking, since
+        the heap is responsible for marking all roots.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedGlobalObjectCount):
+        * runtime/Heap.h:
+        (JSC::Heap::codeBlocks):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/MarkedSpace.cpp: Store the set of global objects in a weak map
+        owned by JSGlobalData, instead of an instrusive circular linked list.
+        This is simpler, and it avoids destructor-time access between garbage
+        collected objects, which is hard to get right.
+
+        (JSC::MarkedSpace::destroy): Make sure to clear mark bits before tearing
+        everything down. Otherwise, weak data structures will incorrectly report
+        that objects pending destruction are still alive.
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(77082): GC-related crashes seen: on WebKit2 bot; on GTK 32bit
+        bot; loading trac pages; typing in search field
+        https://bugs.webkit.org/show_bug.cgi?id=53519
+        
+        The crashes were all caused by failure to run an object's destructor.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::ObjectIterator::ObjectIterator): Don't skip forward upon
+        construction. The iterator class used to do that when it was designed
+        for prior-to-beginning initialization. I forgot to remove this line
+        of code when I changed the iterator to normal initialization.
+        
+        Skipping forward upon construction was causing the heap to skip running
+        the destructor for the very first object in a block when destroying the
+        block. This usually did not crash, since block destruction is rare and
+        most objects have pretty trivial destructors. However, in the rare case
+        when the heap would destroy a block whose first object was a global
+        object or a DOM node, BOOM.
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSObject storage for new marking API
+        https://bugs.webkit.org/show_bug.cgi?id=53467
+
+        JSObject no longer uses EncodedJSValue for its property storage.
+        This produces a stream of mechanical changes to PropertySlot and
+        anonymous storage APIs.
+
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::clearAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::putThisToAnonymousValue):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-02-01  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Modify RandomNumberSeed.h to use USE(MERSENNE_TWISTER_19937)
+        https://bugs.webkit.org/show_bug.cgi?id=53506
+
+        Currently, use of the Mersenne Twister pseudorandom number generator
+        is hardcoded to the Windows CE port. With the passing of bug #53253,
+        we can generalize support for this PRNG to all ports that use srand(3)
+        and rand(3), including Windows CE.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2011-02-01  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MacroAssemblerARM would generate code that did 32bit loads
+        on addresses that were not aligned. More specifically it would
+        generate a ldr r8,[r1, #7] which isn't valid on ARMv5 and lower.
+        The intended instruction really is ldrb r8,[r1, #7]; ensure we
+        call load8 instead of load32.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46095
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+
+2011-02-01  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix some Visual Studio compiler warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=53476
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+        * wtf/ThreadingWin.cpp:
+        (WTF::absoluteTimeToWaitTimeoutInterval):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bogus callframe during stack unwinding
+        https://bugs.webkit.org/show_bug.cgi?id=53454
+
+        Trying to access a callframe's globalData after destroying its
+        ScopeChain is not a good thing.  While we could access the
+        globalData directly through the (known valid) scopechain we're
+        holding on to, it feels fragile.  Instead we push the valid
+        ScopeChain onto the callframe again to ensure that the callframe
+        itself remains valid.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+
+2011-01-31  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this change again.
+        Changed isValid() to use .get() as a result of change r77151.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77098, r77099, r77100, r77109, and
+        r77111 back in, along with a few more Qt fix attempts.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-31  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        wss (websockets ssl) support for gtk via new gio TLS support
+        https://bugs.webkit.org/show_bug.cgi?id=50344
+
+        Add a GPollableOutputStream typedef for TLS WebSockets support
+
+        * wtf/gobject/GTypedefs.h:
+
+2011-01-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76969.
+        http://trac.webkit.org/changeset/76969
+        https://bugs.webkit.org/show_bug.cgi?id=53418
+
+        "It is causing crashes in GTK+ and Leopard bots" (Requested by
+        alexg__ on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r77098, r77099, r77100, r77109, and
+        r77111.
+        http://trac.webkit.org/changeset/77098
+        http://trac.webkit.org/changeset/77099
+        http://trac.webkit.org/changeset/77100
+        http://trac.webkit.org/changeset/77109
+        http://trac.webkit.org/changeset/77111
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Qt build is broken
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix the build fix. I assume Oliver meant m_cell, not m_value.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        More Qt build fixes
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77006 and r77020 back in.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filter all Heap collection through a common reset function, in
+        preparation for adding features triggered by collection.
+        https://bugs.webkit.org/show_bug.cgi?id=53396
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): When we're over the extraCost
+        limit, just call collectAllGarbage() instead of rolling our own special
+        way of resetting the heap. In theory, this may be slower in some cases,
+        but it also fixes cases of pathological heap growth that we've seen,
+        where the only objects being allocated are temporary and huge
+        (<rdar://problem/8885843>).
+
+        (JSC::Heap::allocate):
+        (JSC::Heap::collectAllGarbage): Use the shared reset function.
+
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Carved a new shared reset function out of the old
+        collectAllGarbage.
+
+2011-01-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77025.
+        http://trac.webkit.org/changeset/77025
+        https://bugs.webkit.org/show_bug.cgi?id=53401
+
+        It made js1_5/Regress/regress-159334.js fail on 64 bit Linux
+        (Requested by Ossy on #webkit).
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::reverseSortFreeListEntriesByPointer):
+        (JSC::reverseSortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::maybeModifyVMPoolSize):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+
+2011-01-30  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Daniel Bates.
+
+        Code style issue in JavaScriptCore/wtf/CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=53394
+
+        According to rule #3 at http://webkit.org/coding/coding-style.html,
+        This patch fix style issue in CurrentTime.h.
+
+        No functionality change, no new tests.
+
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime):
+
+2011-01-30  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] JavaScriptCore does not link on Mac if building WebKit 2
+        https://bugs.webkit.org/show_bug.cgi?id=53377
+
+        The option "-whole-archive" is not availabe with the libtool of Mac OS X,
+        instead, we can use "-all_load" on Mac.
+
+        * JavaScriptCore.pri:
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Sorry Leopard bot -- I committed a change by accident.
+
+        * JavaScriptCore.exp: You may have your symbols back now.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified Heap iteration
+        https://bugs.webkit.org/show_bug.cgi?id=53393
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive):
+        (JSC::CollectorHeapIterator::advance): Removed "max" argument to
+        advance because it's a constant.
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++): Factored out common checks into
+        two helper functions -- isValid() for "Am I past the end?" and isLive()
+        for "Is the cell I'm pointing to live?".
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::sweep): Always sweep from the beginning of the heap
+        to the end, to avoid making sweep subtly reliant on internal Heap state.
+        (JSC::MarkedSpace::primaryHeapBegin):
+        (JSC::MarkedSpace::primaryHeapEnd): Always be explicit about where
+        iteration begins.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified heap destruction
+        https://bugs.webkit.org/show_bug.cgi?id=53392
+
+        * JavaScriptCore.exp:
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        * runtime/MarkedSpace.h: Don't go out of our way to destroy GC-protected
+        cells last -- the difficult contortions required to do so just don't seem
+        justified. We make no guarantees about GC protection after the client
+        throws away JSGlobalData, and it doesn't seem like any meaningful
+        guarantee is even possible.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switched heap to use the Bitmap class and removed CollectorBitmap
+        https://bugs.webkit.org/show_bug.cgi?id=53391
+        
+        SunSpider says 1.005x as fast. Seems like a fluke.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Updated for rename and returning a value
+        rather than taking a value by reference.
+
+        * runtime/MarkedSpace.h: Code reuse is good.
+
+        * wtf/Bitmap.h:
+        (WTF::::testAndSet): Added, since this is the one thing Bitmap was missing
+        which CollectorBitmap had. (Renamed from the less conventional "getset".)
+
+        (WTF::::nextPossiblyUnset): Renamed and changed to return a value for
+        clarity. It's all the same with inlining.
+
+2011-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some more Heap cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=53357
+        
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated exported symbols.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Renamed recordExtraCost to 
+        reportExtraMemoryCostSlowCase to match our naming conventions.
+
+        (JSC::Heap::capacity): Renamed size to capacity because this function
+        returns the capacity of the heap, including unused portions.
+
+        * runtime/Heap.h:
+        (JSC::Heap::globalData):
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::machineStackMarker):
+        (JSC::Heap::reportExtraMemoryCost): Moved statics to the top of the file.
+        Moved ctor and dtor to the beginning of the class definition. Grouped
+        functions by purpose.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::capacity): Renamed size to capacity because this
+        function returns the capacity of the heap, including unused portions.
+
+        * runtime/MarkedSpace.h: Removed statistics and the Statistics class because
+        the same information can be gotten just by calling size() and capacity().
+
+        * runtime/MemoryStatistics.cpp:
+        * runtime/MemoryStatistics.h: Ditto.
+
+2011-01-29  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move wince/mt19937ar.c to ThirdParty and make it a policy choice
+        https://bugs.webkit.org/show_bug.cgi?id=53253
+
+        Make inclusion of MT19937 a policy decision.
+
+        Currently, we hardcoded to  use MT19937 when building for
+        Windows CE. Instead, we should make this a policy decision
+        with the Windows CE port using this by default.
+
+        * JavaScriptCore.pri: Append Source/ThirdParty to the end
+        of the list include directories.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/Platform.h: Defined WTF_USE_MERSENNE_TWISTER_19937 when
+        building for Windows CE.
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Substituted USE(MERSENNE_TWISTER_19937) for OS(WINCE).
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Bug 53374 - Remove uses of unsafe string functions in debugging code
+        https://bugs.webkit.org/show_bug.cgi?id=53374
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::printTraceData):
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JavaScriptCoreUseJIT environment variable broken
+        https://bugs.webkit.org/show_bug.cgi?id=53372
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Check the actual value in the string returned
+        by getenv() rather than just doing a NULL check on the return value.
+
+2011-01-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Move CharacterNames.h into WTF directory
+        https://bugs.webkit.org/show_bug.cgi?id=49618
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/unicode/CharacterNames.h: Renamed from WebCore/platform/text/CharacterNames.h.
+        * wtf/unicode/UTF8.cpp:
+
+2011-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add various clampToInt() methods to MathExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=52910
+        
+        Add functions for clamping doubles and floats to valid int
+        ranges, for signed and positive integers.
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77006 and r77020.
+        http://trac.webkit.org/changeset/77006
+        http://trac.webkit.org/changeset/77020
+        https://bugs.webkit.org/show_bug.cgi?id=53360
+
+        "Broke Windows tests" (Requested by rniwa on #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Move the MarkStack over to a slot based marking API.
+
+        In order to avoiding aliasing concerns there are two new types
+        that need to be used when holding on to JSValues and JSCell that
+        need to be marked: WriteBarrier and DeprecatedPtr.  WriteBarrier
+        is expected to be used for any JSValue or Cell that's lifetime and
+        marking is controlled by another GC object.  DeprecatedPtr is used
+        for any value that we need to rework ownership for.
+
+        The change over to this model has produced a large amount of
+        code changes, but they are mostly mechanical (forwarding JSGlobalData,
+        etc).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Register.h:
+        (JSC::Register::jsValueSlot):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::appendCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-28  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix after r76967
+
+        * wtf/ThreadingPrimitives.h: Use OS(WINDOWS) instead of PLATFORM(WIN), to match other
+        similar macros in this file.
+
+2011-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this this change.  No change from prior patch in
+        JavaScriptCore.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Extract code to convert a WTF absolute time to a Win32 wait interval into a separate
+        function
+
+        Fixes <http://webkit.org/b/53208> <rdar://problem/8922490> BinarySemaphore should wrap a
+        Win32 event
+
+        Reviewed by Dave Hyatt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new function.
+
+        * wtf/ThreadingPrimitives.h: Declare the new function.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): Moved code to convert the absolute time to a wait
+        interval from here...
+        (WTF::absoluteTimeToWaitTimeoutInterval): ...to here.
+
+2011-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add basic rubber banding support
+        <rdar://problem/8219429>
+        https://bugs.webkit.org/show_bug.cgi?id=53277
+
+        * wtf/Platform.h: Add ENABLE for rubber banding.
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76893.
+        http://trac.webkit.org/changeset/76893
+        https://bugs.webkit.org/show_bug.cgi?id=53287
+
+        It made some tests crash on GTK and Qt debug bots (Requested
+        by Ossy on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTFString method to compare equality with Vector<UChar>
+        https://bugs.webkit.org/show_bug.cgi?id=53266
+
+        I'm planning to use this method in the new XSS filter implementation,
+        but it seems generally useful.
+
+        * wtf/text/StringImpl.h:
+        (WTF::equalIgnoringNullity):
+        * wtf/text/WTFString.h:
+        (WTF::equalIgnoringNullity):
+
+2011-01-27  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add events to represent the start/end of a gesture scroll
+        https://bugs.webkit.org/show_bug.cgi?id=53215
+
+        * wtf/Platform.h: Add ENABLE for gesture events. 
+
+2011-01-26  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Fix --minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=52839
+
+        Move definition of USE_SYSTEM_MALLOC out of pri file.
+        Put it in platform.h instead.
+
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/wtf.pri:
+
+2011-01-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Add JIT support to build system
+        https://bugs.webkit.org/show_bug.cgi?id=53079
+
+        * CMakeListsWinCE.txt:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Set BUILDSTYLE to Release_PGO at the very start
+        of the file so that ConfigurationBuildDir takes that into account. Also set it the right way
+        (by redefining the macro) rather than the wrong way (by modifying the environment variable).
+
+2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Windows production build fix.
+        Use correct environment variable escaping
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-01-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSON.stringify processing time exponentially grows with size of object
+        https://bugs.webkit.org/show_bug.cgi?id=51922
+
+        Remove last use of reserveCapacity from JSON stringification, as it results
+        in appalling append behaviour when there are a large number of property names
+        and nothing else.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        Try to fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION: Leak in JSParser::Scope::copyCapturedVariablesToVector()
+        https://bugs.webkit.org/show_bug.cgi?id=53061
+         
+        Cache did not know about the subclass so failed to fully delete the items. 
+        Got rid of the subclass and moved the classes to separate files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/SourceProvider.h:
+        * parser/SourceProviderCache.cpp: Added.
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        * parser/SourceProviderCache.h: Added.
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        * parser/SourceProviderCacheItem.h: Added.
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::approximateByteSize):
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+
+2011-01-25  Marcilio Mendonca  <mamendonca@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 53087: Refactoring: replaced a hanging "else" with a "return"
+        statement
+        https://bugs.webkit.org/show_bug.cgi?id=53087.
+
+        Refactoring work: Replaced a hanging "else" within an #if PLATFORM(M
+        with a "return" so that the code is more readable and less error pro
+        (e.g., "else" doesn't use braces so adding extra lines to the else
+        block won't have any effect; even worse, code still compiles
+        successfully.
+
+        * wtf/Assertions.cpp:
+
+2011-01-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Change ENABLE_3D_CANVAS to ENABLE_WEBGL
+        https://bugs.webkit.org/show_bug.cgi?id=53041
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Added a missing "set".
+
+2011-01-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing defines for COMPILER(RVCT) && CPU(ARM_THUMB2)
+        https://bugs.webkit.org/show_bug.cgi?id=52949
+
+        * jit/JITStubs.cpp:
+
+2011-01-24  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Update for move of JavaScriptCore into Source.
+
+2011-01-24  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Optimize regex patterns which contain empty alternatives
+        https://bugs.webkit.org/show_bug.cgi?id=51395
+
+        Eliminate the empty alternatives from the regex pattern and convert it to do
+        the matching in an easier way.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+
+2011-01-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Move project files into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52891
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2011-01-23  Mark Rowe  <mrowe@apple.com>
+
+        Follow-up to r76477.
+
+        Fix the scripts that detect problematic code such as static initializers
+        and destructors, weak vtables, inappropriate files in the framework wrappers,
+        and public headers including private headers. These had all been broken
+        since the projects were moved in to the Source directory as the paths to the
+        scripts were not updated at that time.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use WTF::StringHasher in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=52934
+
+        Add an additional function to calculate the hash
+        of data with a runtimedependent size.
+
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::createBlobHash):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Fix comment in String::ascii()
+        https://bugs.webkit.org/show_bug.cgi?id=52980
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add String::containsOnlyLatin1()
+        https://bugs.webkit.org/show_bug.cgi?id=52979
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyLatin1):
+        (WTF::charactersAreAllLatin1):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52948
+
+        r70111 removed support for JSVALUE32.
+        ARM, MIPS and X86 support JSVALUE32_64 only.
+
+        * jit/JITStubs.cpp:
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERT running run-webkit-tests --threaded.
+        https://bugs.webkit.org/show_bug.cgi?id=52971
+        
+        SunSpider and v8 report no change.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Tweaked the inline capacity to 128, and
+        the growth policy to 2X, to make SunSpider and v8 happy.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark): Use OSAllocator directly, instead of malloc.
+        Malloc is forbidden during a multi-threaded mark phase because it can
+        cause deadlock.
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build systems.
+
+        * runtime/ConservativeSet.cpp: Added.
+        (JSC::isPointerAligned):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Added.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::mark): Split ConservativeSet out into its own
+        file, and moved the conservative check into ConservativeSet::add, making
+        ConservativeSet's responsibility clearer.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h: Updated for changes above.
+
+2011-01-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76430.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Reorganized MarkedSpace, making many of its functions private.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::heap):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::heap):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix build: moved helper function out of #ifdef.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards): Added a helper function for handling platforms
+        where the stack can grow in any direction.
+
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively): Use the helper
+        function.
+
+        (JSC::isPointerAligned): Use "!" instead of "==0" because a robot told me to.
+
+        (JSC::MachineStackMarker::markConservatively): Changed to use a more
+        standard looping idiom, and to use the helper function above.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned): Use "!" instead of "==0" because a robot told me to.
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleaned up some conservative marking code.
+        https://bugs.webkit.org/show_bug.cgi?id=52946
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h: No need for a special marking function,
+        since we already expose a start() and end().
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::registerFile):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::contains): Migrated markConservatively() to the machine stack
+        marker class. Now, Heap just provides a contains() function, which the
+        machine stack marker uses for checking whether a pointer points into the heap.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::isPointerAligned):
+        (JSC::MachineStackMarker::markConservatively):
+        * runtime/MachineStackMarker.h: Move the conservative marking code here.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Changed to using a vector instead of hash
+        set. Vector seems to be a bit faster, and it generates smaller code.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::containsSlowCase):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned):
+        (JSC::MarkedSpace::isPossibleCell):
+        (JSC::MarkedSpace::contains): Kept the code for determining whether a
+        pointer pointed into marked space, and moved the code for marking
+        a set of conservative pointers into the machine stack marker.
+
+        * wtf/HashSet.h:
+        (WTF::::add): Added two missing inlines that I noticed while testing
+        vector vs hash set.
+
+2011-01-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around a Clang bug <rdar://problem/8876150> that leads to it incorrectly emitting an access
+        control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator bool):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::operator bool):
+
 2011-01-21  Michael Saboff  <msaboff@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 46d5de4..3971037 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -38,10 +38,10 @@ ENABLE_ACCELERATED_2D_CANVAS_macosx = $(ENABLE_ACCELERATED_2D_CANVAS_macosx_$(TA
 ENABLE_ACCELERATED_2D_CANVAS_macosx_1060 = ;
 ENABLE_ACCELERATED_2D_CANVAS_macosx_1070 = ;
 
-ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(REAL_PLATFORM_NAME));
-ENABLE_3D_CANVAS_macosx = $(ENABLE_3D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ENABLE_3D_CANVAS_macosx_1060 = ENABLE_3D_CANVAS;
-ENABLE_3D_CANVAS_macosx_1070 = ENABLE_3D_CANVAS;
+ENABLE_WEBGL = $(ENABLE_WEBGL_$(REAL_PLATFORM_NAME));
+ENABLE_WEBGL_macosx = $(ENABLE_WEBGL_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_WEBGL_macosx_1060 = ENABLE_WEBGL;
+ENABLE_WEBGL_macosx_1070 = ENABLE_WEBGL;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(REAL_PLATFORM_NAME));
 ENABLE_3D_RENDERING_iphoneos = ENABLE_3D_RENDERING;
@@ -91,6 +91,8 @@ ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_REGISTER_PROTOCOL_HANDLER = ;
+
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
 ENABLE_SHARED_WORKERS_macosx = ENABLE_SHARED_WORKERS;
 
@@ -106,6 +108,8 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 
+ENABLE_MEDIA_STATISTICS = ;
+
 ENABLE_WEB_AUDIO = ;
 
 ENABLE_WEB_SOCKETS = $(ENABLE_WEB_SOCKETS_$(REAL_PLATFORM_NAME));
@@ -121,4 +125,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
index 69b2491..adf594e 100644
--- a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
+++ b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
@@ -26,11 +26,11 @@
 
 JSVALUE_MODEL = $(JSVALUE_MODEL_$(CURRENT_ARCH));
 JSVALUE_MODEL_ = UNKNOWN_JSVALUE_MODEL;
-JSVALUE_MODEL_armv6 = 32;
+JSVALUE_MODEL_armv6 = 32_64;
 JSVALUE_MODEL_armv7 = 32_64;
 JSVALUE_MODEL_i386 = 32_64;
 JSVALUE_MODEL_ppc = 32_64;
-JSVALUE_MODEL_ppc64 = 32;
+JSVALUE_MODEL_ppc64 = 64;
 JSVALUE_MODEL_x86_64 = 64;
 
 EXPORTED_SYMBOLS_FILE = $(BUILT_PRODUCTS_DIR)/DerivedSources/JavaScriptCore/JavaScriptCore.JSVALUE$(JSVALUE_MODEL).exp;
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index 4b884e2..cee5010 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 16;
+MINOR_VERSION = 20;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 748e254..0ff9cdf 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -27,7 +27,6 @@
 VPATH = \
     $(JavaScriptCore) \
     $(JavaScriptCore)/parser \
-    $(JavaScriptCore)/pcre \
     $(JavaScriptCore)/docs \
     $(JavaScriptCore)/runtime \
     $(JavaScriptCore)/interpreter \
@@ -40,7 +39,6 @@ all : \
     DatePrototype.lut.h \
     HeaderDetection.h \
     JSONObject.lut.h \
-    JavaScriptCore.JSVALUE32.exp \
     JavaScriptCore.JSVALUE32_64.exp \
     JavaScriptCore.JSVALUE64.exp \
     Lexer.lut.h \
@@ -50,7 +48,6 @@ all : \
     RegExpJitTables.h \
     RegExpObject.lut.h \
     StringPrototype.lut.h \
-    chartables.c \
     docs/bytecode.html \
 #
 
@@ -61,11 +58,6 @@ all : \
 Lexer.lut.h: create_hash_table Keywords.table
 	$^ > $@
 
-# character tables for PCRE
-
-chartables.c : dftables
-	$^ $@
-
 docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
 	perl $^ $@
 
@@ -76,16 +68,26 @@ RegExpJitTables.h: create_regex_tables
 
 # export files
 
-JavaScriptCore.JSVALUE32.exp: JavaScriptCore.exp JavaScriptCore.JSVALUE32only.exp
-	cat $^ > $@
-
 JavaScriptCore.JSVALUE32_64.exp: JavaScriptCore.exp JavaScriptCore.JSVALUE32_64only.exp
 	cat $^ > $@
 
 JavaScriptCore.JSVALUE64.exp: JavaScriptCore.exp JavaScriptCore.JSVALUE64only.exp
 	cat $^ > $@
 
+
 # header detection
 
-HeaderDetection.h : DerivedSources.make
-	if [ -f $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" > $@; else echo > $@; fi
+ifeq ($(OS),MACOS)
+
+HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersion.plist
+	rm -f $@
+	echo "/* This is a generated file. Do not edit. */" > $@
+	if [ -f $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" >> $@; else echo >> $@; fi
+	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
+
+else
+
+HeaderDetection.h :
+	echo > $@
+
+endif
diff --git a/Source/JavaScriptCore/DerivedSources.pro b/Source/JavaScriptCore/DerivedSources.pro
index 4d724be..eac4dd9 100644
--- a/Source/JavaScriptCore/DerivedSources.pro
+++ b/Source/JavaScriptCore/DerivedSources.pro
@@ -83,15 +83,6 @@ msvcstubs.input = JIT_STUB_FILES
 msvcstubs.CONFIG += no_link
 addExtraCompiler(msvcstubs)
 
-# GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
-win32-msvc*|wince*: PREPROCESSOR = "--preprocessor=\"$$QMAKE_CC /E\""
-ctgen.output = $$JSC_GENERATED_SOURCES_DIR/chartables.c
-ctgen.wkScript = $$PWD/pcre/dftables
-ctgen.input = ctgen.wkScript
-ctgen.commands = perl $$ctgen.wkScript ${QMAKE_FILE_OUT} $$PREPROCESSOR
-ctgen.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_JSC_GENERATED_SOURCES_DIR}${QMAKE_FILE_BASE}
-addExtraCompiler(ctgen)
-
 #GENERATOR: "RegExpJitTables.h": tables used by Yarr
 retgen.output = $$JSC_GENERATED_SOURCES_DIR/RegExpJitTables.h
 retgen.wkScript = $$PWD/create_regex_tables 
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index 7272471..e6ccf2e 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -11,7 +11,6 @@ javascriptcore_cppflags += \
 	-I$(srcdir)/Source/JavaScriptCore/jit \
 	-I$(srcdir)/Source/JavaScriptCore/jit \
 	-I$(srcdir)/Source/JavaScriptCore/parser \
-	-I$(srcdir)/Source/JavaScriptCore/pcre \
 	-I$(srcdir)/Source/JavaScriptCore/profiler \
 	-I$(srcdir)/Source/JavaScriptCore/runtime \
 	-I$(srcdir)/Source/JavaScriptCore/wtf \
@@ -23,7 +22,6 @@ javascriptcore_cppflags += \
 	-I$(srcdir)/Source/JavaScriptCore/yarr \
 	-I$(top_builddir)/Source/JavaScriptCore \
 	-I$(top_builddir)/Source/JavaScriptCore/parser \
-	-I$(top_builddir)/Source/JavaScriptCore/pcre \
 	-I$(top_builddir)/Source/JavaScriptCore/runtime
 
 javascriptcore_h_api += \
@@ -48,8 +46,7 @@ javascriptcore_built_nosources += \
 	Source/JavaScriptCore/runtime/NumberConstructor.lut.h \
 	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
 	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
-	Source/JavaScriptCore/runtime/StringPrototype.lut.h \
-	Source/JavaScriptCore/pcre/chartables.c
+	Source/JavaScriptCore/runtime/StringPrototype.lut.h
 
 javascriptcore_sources += \
 	Source/JavaScriptCore/API/APICast.h \
@@ -202,15 +199,10 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/parser/ResultType.h \
 	Source/JavaScriptCore/parser/SourceCode.h \
 	Source/JavaScriptCore/parser/SourceProvider.h \
+	Source/JavaScriptCore/parser/SourceProviderCache.cpp \
+	Source/JavaScriptCore/parser/SourceProviderCache.h \
+	Source/JavaScriptCore/parser/SourceProviderCacheItem.h \
 	Source/JavaScriptCore/parser/SyntaxChecker.h \
-	Source/JavaScriptCore/pcre/pcre_compile.cpp \
-	Source/JavaScriptCore/pcre/pcre_exec.cpp \
-	Source/JavaScriptCore/pcre/pcre.h \
-	Source/JavaScriptCore/pcre/pcre_internal.h \
-	Source/JavaScriptCore/pcre/pcre_tables.cpp \
-	Source/JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp \
-	Source/JavaScriptCore/pcre/pcre_xclass.cpp \
-	Source/JavaScriptCore/pcre/ucpinternal.h \
 	Source/JavaScriptCore/profiler/CallIdentifier.h \
 	Source/JavaScriptCore/profiler/Profile.cpp \
 	Source/JavaScriptCore/profiler/ProfileGenerator.cpp \
@@ -239,11 +231,12 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/CallData.cpp \
 	Source/JavaScriptCore/runtime/CallData.h \
 	Source/JavaScriptCore/runtime/ClassInfo.h \
+	Source/JavaScriptCore/runtime/MarkedBlock.cpp \
+	Source/JavaScriptCore/runtime/MarkedBlock.h \
 	Source/JavaScriptCore/runtime/MarkedSpace.cpp \
 	Source/JavaScriptCore/runtime/MarkedSpace.h \
 	Source/JavaScriptCore/runtime/Heap.cpp \
 	Source/JavaScriptCore/runtime/Heap.h \
-	Source/JavaScriptCore/runtime/CollectorHeapIterator.h \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
 	Source/JavaScriptCore/runtime/Completion.cpp \
@@ -343,6 +336,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/Lookup.h \
 	Source/JavaScriptCore/runtime/MachineStackMarker.cpp \
 	Source/JavaScriptCore/runtime/MachineStackMarker.h \
+        Source/JavaScriptCore/runtime/ConservativeSet.cpp \
+        Source/JavaScriptCore/runtime/ConservativeSet.h \
 	Source/JavaScriptCore/runtime/MarkStack.cpp \
 	Source/JavaScriptCore/runtime/MarkStack.h \
 	Source/JavaScriptCore/runtime/MathObject.cpp \
@@ -423,6 +418,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/WeakGCMap.h \
 	Source/JavaScriptCore/runtime/WeakGCPtr.h \
 	Source/JavaScriptCore/runtime/WeakRandom.h \
+	Source/JavaScriptCore/runtime/WriteBarrier.h \
 	Source/JavaScriptCore/wtf/AlwaysInline.h \
 	Source/JavaScriptCore/wtf/ASCIICType.h \
 	Source/JavaScriptCore/wtf/Assertions.cpp \
@@ -430,10 +426,13 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/Atomics.h \
 	Source/JavaScriptCore/wtf/AVLTree.h \
 	Source/JavaScriptCore/wtf/Bitmap.h \
+	Source/JavaScriptCore/wtf/BloomFilter.h \
 	Source/JavaScriptCore/wtf/BumpPointerAllocator.h \
 	Source/JavaScriptCore/wtf/ByteArray.cpp \
 	Source/JavaScriptCore/wtf/ByteArray.h \
 	Source/JavaScriptCore/wtf/CrossThreadRefCounted.h \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
 	Source/JavaScriptCore/wtf/CurrentTime.cpp \
 	Source/JavaScriptCore/wtf/CurrentTime.h \
 	Source/JavaScriptCore/wtf/DateMath.cpp \
@@ -482,9 +481,10 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/NotFound.h \
 	Source/JavaScriptCore/wtf/NullPtr.h \
 	Source/JavaScriptCore/wtf/OSAllocator.h \
+	Source/JavaScriptCore/wtf/OSRandomSource.cpp \
+	Source/JavaScriptCore/wtf/OSRandomSource.h \
 	Source/JavaScriptCore/wtf/OwnArrayPtr.h \
 	Source/JavaScriptCore/wtf/OwnFastMallocPtr.h \
-	Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h \
 	Source/JavaScriptCore/wtf/OwnPtrCommon.h \
 	Source/JavaScriptCore/wtf/OwnPtr.h \
 	Source/JavaScriptCore/wtf/PageAllocation.h \
@@ -547,6 +547,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/ThreadSpecific.h \
 	Source/JavaScriptCore/wtf/TypeTraits.cpp \
 	Source/JavaScriptCore/wtf/TypeTraits.h \
+	Source/JavaScriptCore/wtf/unicode/CharacterNames.h \
 	Source/JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
 	Source/JavaScriptCore/wtf/unicode/Collator.h \
 	Source/JavaScriptCore/wtf/unicode/Unicode.h \
@@ -609,9 +610,6 @@ Source/JavaScriptCore/%.lut.h: $(srcdir)/Source/JavaScriptCore/create_hash_table
 Source/JavaScriptCore/RegExpJitTables.h: $(srcdir)/Source/JavaScriptCore/create_regex_tables
 	$(AM_V_GEN)$(PYTHON) $^ > $@
 
-Source/JavaScriptCore/pcre/chartables.c: $(srcdir)/Source/JavaScriptCore/pcre/dftables
-	$(AM_V_GEN)$(PERL) $^ $@
-
 jsc: $(javascriptcore_built_nosources) Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@$(EXEEXT);
 
 bin_PROGRAMS += \
@@ -686,10 +684,6 @@ EXTRA_DIST += \
 	Source/JavaScriptCore/icu/LICENSE \
 	Source/JavaScriptCore/icu/README \
 	Source/JavaScriptCore/parser/Keywords.table \
-	Source/JavaScriptCore/pcre/AUTHORS \
-	Source/JavaScriptCore/pcre/COPYING \
-	Source/JavaScriptCore/pcre/dftables \
-	Source/JavaScriptCore/pcre/ucptable.cpp \
 	Source/JavaScriptCore/THANKS
 
 # Clean rules for JavaScriptCore
@@ -702,7 +696,6 @@ CLEANFILES += \
 	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
 	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
 	Source/JavaScriptCore/runtime/StringPrototype.lut.h \
-	Source/JavaScriptCore/pcre/chartables.c \
 	Programs/jsc \
 	Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@ \
 	Programs/minidom
diff --git a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32only.exp b/Source/JavaScriptCore/JavaScriptCore.JSVALUE32only.exp
deleted file mode 100644
index 73efb9d..0000000
--- a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32only.exp
+++ /dev/null
@@ -1,2 +0,0 @@
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFPvS2_E
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFPvS2_E
diff --git a/Source/JavaScriptCore/JavaScriptCore.exp b/Source/JavaScriptCore/JavaScriptCore.exp
index 2e999ef..564d7db 100644
--- a/Source/JavaScriptCore/JavaScriptCore.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.exp
@@ -93,11 +93,9 @@ _WTFLogVerbose
 _WTFReportArgumentAssertionFailure
 _WTFReportAssertionFailure
 _WTFReportAssertionFailureWithMessage
+_WTFReportBacktrace
 _WTFReportError
 _WTFReportFatalError
-__Z12jsRegExpFreeP8JSRegExp
-__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
-__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
 __ZN14OpaqueJSString6createERKN3JSC7UStringE
 __ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPN3WTF10StringImplE
 __ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPN3WTF10StringImplE
@@ -166,7 +164,6 @@ __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
-__ZN3JSC14heapStatisticsEPNS_12JSGlobalDataE
 __ZN3JSC14throwTypeErrorEPNS_9ExecStateE
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
 __ZN3JSC15createTypeErrorEPNS_9ExecStateERKNS_7UStringE
@@ -183,7 +180,7 @@ __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
 __ZN3JSC17PropertyNameArray3addEPN3WTF10StringImplE
 __ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
 __ZN3JSC17createSyntaxErrorEPNS_9ExecStateERKNS_7UStringE
-__ZN3JSC18DebuggerActivationC1EPNS_8JSObjectE
+__ZN3JSC18DebuggerActivationC1ERNS_12JSGlobalDataEPNS_8JSObjectE
 __ZN3JSC18PropertyDescriptor11setWritableEb
 __ZN3JSC18PropertyDescriptor12setUndefinedEv
 __ZN3JSC18PropertyDescriptor13setDescriptorENS_7JSValueEj
@@ -193,6 +190,8 @@ __ZN3JSC18PropertyDescriptor17defaultAttributesE
 __ZN3JSC18PropertyDescriptor21setAccessorDescriptorENS_7JSValueES1_j
 __ZN3JSC18PropertyDescriptor9setGetterENS_7JSValueE
 __ZN3JSC18PropertyDescriptor9setSetterENS_7JSValueE
+__ZN3JSC19SourceProviderCache5clearEv
+__ZN3JSC19SourceProviderCacheD1Ev
 __ZN3JSC19initializeThreadingEv
 __ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
 __ZN3JSC20createReferenceErrorEPNS_9ExecStateERKNS_7UStringE
@@ -207,23 +206,24 @@ __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
 __ZN3JSC3NaNE
-__ZN3JSC4Heap14primaryHeapEndEv
 __ZN3JSC4Heap15addWeakGCHandleEPNS_6JSCellE
-__ZN3JSC4Heap15recordExtraCostEm
 __ZN3JSC4Heap16objectTypeCountsEv
-__ZN3JSC4Heap16primaryHeapBeginEv
 __ZN3JSC4Heap17collectAllGarbageEv
 __ZN3JSC4Heap17globalObjectCountEv
 __ZN3JSC4Heap19setActivityCallbackEN3WTF10PassOwnPtrINS_18GCActivityCallbackEEE
 __ZN3JSC4Heap20protectedObjectCountEv
 __ZN3JSC4Heap25protectedObjectTypeCountsEv
 __ZN3JSC4Heap26protectedGlobalObjectCountEv
+__ZN3JSC4Heap29reportExtraMemoryCostSlowCaseEm
 __ZN3JSC4Heap6isBusyEv
 __ZN3JSC4Heap7destroyEv
 __ZN3JSC4Heap7protectENS_7JSValueE
 __ZN3JSC4Heap8allocateEm
 __ZN3JSC4Heap9unprotectENS_7JSValueE
 __ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC4Yarr11YarrPatternC1ERKNS_7UStringEbbPPKc
+__ZN3JSC4Yarr11byteCompileERNS0_11YarrPatternEPN3WTF20BumpPointerAllocatorE
+__ZN3JSC4Yarr9interpretEPNS0_15BytecodePatternEPKtjjPi
 __ZN3JSC6JSCell11getCallDataERNS_8CallDataE
 __ZN3JSC6JSCell11getJSNumberEv
 __ZN3JSC6JSCell14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
@@ -250,7 +250,7 @@ __ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSC7JSArray4infoE
 __ZN3JSC7JSArray9setLengthEj
 __ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEE
-__ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7ArgListE
+__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7ArgListE
 __ZN3JSC7JSArrayC2EN3WTF17NonNullPassRefPtrINS_9StructureEEE
 __ZN3JSC7JSArrayD2Ev
 __ZN3JSC7JSValue13isValidCalleeEv
@@ -295,7 +295,7 @@ __ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
 __ZN3JSC8JSObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
 __ZN3JSC8JSObject21getPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
-__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE  
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_16WriteBarrierBaseINS_7UnknownEEE
 __ZN3JSC8JSObject23allocatePropertyStorageEmm
 __ZN3JSC8JSObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
@@ -431,6 +431,7 @@ __ZN3WTF23dayInMonthFromDayInYearEib
 __ZN3WTF23waitForThreadCompletionEjPPv
 __ZN3WTF27releaseFastMallocFreeMemoryEv
 __ZN3WTF28setMainThreadCallbacksPausedEb
+__ZN3WTF29cryptographicallyRandomValuesEPvm
 __ZN3WTF36lockAtomicallyInitializedStaticMutexEv
 __ZN3WTF37parseDateFromNullTerminatedCharactersEPKc
 __ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
@@ -516,10 +517,11 @@ __ZNK3JSC18PropertyDescriptor20isAccessorDescriptorEv
 __ZNK3JSC18PropertyDescriptor6getterEv
 __ZNK3JSC18PropertyDescriptor6setterEv
 __ZNK3JSC18PropertyDescriptor8writableEv
+__ZNK3JSC19SourceProviderCache8byteSizeEv
 __ZNK3JSC24JSObjectWithGlobalObject12globalObjectEv
-__ZNK3JSC4Heap10statisticsEv
 __ZNK3JSC4Heap11objectCountEv
 __ZNK3JSC4Heap4sizeEv
+__ZNK3JSC4Heap8capacityEv
 __ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell14isGetterSetterEv
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index 56304fa..08e590b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -170,7 +170,7 @@
       ],
     },
     {
-      'target_name': 'pcre',
+      'target_name': 'yarr',
       'type': '<(library)',
       'dependencies': [
         'wtf',
@@ -183,18 +183,19 @@
       'msvs_guid': '49909552-0B0C-4C14-8CF6-DB8A2ADE0934',
       'actions': [
         {
-          'action_name': 'dftables',
+          'action_name': 'retgen',
           'inputs': [
-            '../pcre/dftables',
+            '../create_regex_tables',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/chartables.c',
+            '<(INTERMEDIATE_DIR)/RegExpJitTables.h',
           ],
-          'action': ['perl', '-w', '<@(_inputs)', '<@(_outputs)'],
+          'action': ['python', '<@(_inputs)', '<@(_outputs)'],
         },
       ],
       'include_dirs': [
         '<(INTERMEDIATE_DIR)',
+        '../runtime',
       ],
       'sources': [
         '<@(javascriptcore_files)',
@@ -203,10 +204,9 @@
         # First exclude everything ...
         ['exclude', '../'],
         # ... Then include what we want.
-        ['include', '../pcre/'],
-        # ucptable.cpp is #included by pcre_ucp_searchfunchs.cpp and is not
-        # intended to be compiled directly.
-        ['exclude', '../pcre/ucptable.cpp$'],
+        ['include', '../yarr/'],
+        # The Yarr JIT isn't used in WebCore.
+        ['exclude', '../yarr/YarrJIT\\.(h|cpp)$'],
       ],
       'export_dependent_settings': [
         'wtf',
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index 6ca18a0..754fd2b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -144,16 +144,10 @@
             'parser/ResultType.h',
             'parser/SourceCode.h',
             'parser/SourceProvider.h',
+            'parser/SourceProviderCache.cpp',
+            'parser/SourceProviderCache.h',
+            'parser/SourceProviderCacheItem.h',
             'parser/SyntaxChecker.h',
-            'pcre/pcre.h',
-            'pcre/pcre_compile.cpp',
-            'pcre/pcre_exec.cpp',
-            'pcre/pcre_internal.h',
-            'pcre/pcre_tables.cpp',
-            'pcre/pcre_ucp_searchfuncs.cpp',
-            'pcre/pcre_xclass.cpp',
-            'pcre/ucpinternal.h',
-            'pcre/ucptable.cpp',
             'profiler/CallIdentifier.h',
             'profiler/Profile.cpp',
             'profiler/Profile.h',
@@ -182,11 +176,12 @@
             'runtime/CallData.cpp',
             'runtime/CallData.h',
             'runtime/ClassInfo.h',
+            'runtime/MarkedBlock.cpp',
+            'runtime/MarkedBlock.h',
             'runtime/MarkedSpace.cpp',
             'runtime/MarkedSpace.h',
             'runtime/Heap.cpp',
             'runtime/Heap.h',
-            'runtime/CollectorHeapIterator.h',
             'runtime/CommonIdentifiers.cpp',
             'runtime/CommonIdentifiers.h',
             'runtime/Completion.cpp',
@@ -280,6 +275,8 @@
             'runtime/Lookup.h',
             'runtime/MachineStackMarker.cpp',
             'runtime/MachineStackMarker.h',
+            'runtime/ConservativeSet.cpp',
+            'runtime/ConservativeSet.h',
             'runtime/MarkStack.cpp',
             'runtime/MarkStack.h',
             'runtime/MarkStackWin.cpp',
@@ -361,11 +358,14 @@
             'wtf/Atomics.h',
             'wtf/AVLTree.h',
             'wtf/Bitmap.h',
+            'wtf/BloomFilter.h',
             'wtf/ByteArray.cpp',
             'wtf/ByteArray.h',
             'wtf/chromium/ChromiumThreading.h',
             'wtf/chromium/MainThreadChromium.cpp',
             'wtf/CrossThreadRefCounted.h',
+            'wtf/CryptographicallyRandomNumber.cpp',
+            'wtf/CryptographicallyRandomNumber.h',
             'wtf/CurrentTime.cpp',
             'wtf/CurrentTime.h',
             'wtf/DateMath.cpp',
@@ -408,6 +408,8 @@
             'wtf/OSAllocatorPosix.cpp',
             'wtf/OSAllocatorWin.cpp',
             'wtf/OSAllocator.h',
+            'wtf/OSRandomSource.cpp',
+            'wtf/OSRandomSource.h',
             'wtf/OwnArrayPtr.h',
             'wtf/OwnFastMallocPtr.h',
             'wtf/OwnPtr.h',
@@ -477,6 +479,7 @@
             'wtf/text/TextPosition.h',
             'wtf/text/WTFString.cpp',
             'wtf/text/WTFString.h',
+            'wtf/unicode/CharacterNames.h',
             'wtf/unicode/Collator.h',
             'wtf/unicode/CollatorDefault.cpp',
             'wtf/unicode/glib/UnicodeGLib.cpp',
@@ -498,7 +501,7 @@
             'wtf/win/MainThreadWin.cpp',
             'wtf/win/OwnPtrWin.cpp',
             'wtf/wx/MainThreadWx.cpp',
-            'yarr/Yarr.h'
+            'yarr/Yarr.h',
             'yarr/YarrInterpreter.cpp',
             'yarr/YarrInterpreter.h',
             'yarr/YarrJIT.cpp',
@@ -511,3 +514,4 @@
         ]
     }
 }
+
diff --git a/Source/JavaScriptCore/JavaScriptCore.order b/Source/JavaScriptCore/JavaScriptCore.order
index 3cb3d1d..9e4004f 100644
--- a/Source/JavaScriptCore/JavaScriptCore.order
+++ b/Source/JavaScriptCore/JavaScriptCore.order
@@ -185,11 +185,9 @@ __ZN3WTF31clearPthreadHandleForIdentifierEj
 __ZN3WTF12detachThreadEj
 __ZN3WTFL26pthreadHandleForIdentifierEj
 __ZN7WebCore6StringC1EPKtj
-__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
 __ZL30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
 __ZL11checkEscapePPKtS0_P9ErrorCodeib
 __ZL13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
-__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
 __ZL5matchPKtPKhiR9MatchData
 __ZN7WebCore6String6formatEPKcz
 __ZNK7WebCore6String19characterStartingAtEj
@@ -1534,7 +1532,6 @@ __ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
 _cti_op_to_primitive
 __ZN3JSC15constructNumberEPNS_9ExecStateENS_7JSValueE
 __ZNK3JSC12NumberObject9classInfoEv
-__Z12jsRegExpFreeP8JSRegExp
 __ZN3JSC13BooleanObjectD1Ev
 __ZN3JSCL18stringFromCharCodeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC10makeStringIPKcNS_7UStringES2_EES3_T_T0_T1_
@@ -1545,7 +1542,6 @@ __ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
 __ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC12RegExpObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSCL24setRegExpObjectLastIndexEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
-__Z15jsc_pcre_xclassiPKh
 __ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierE
 __ZNK3JSC17RegExpConstructor14getLeftContextEPNS_9ExecStateE
 _cti_to_object
@@ -1790,7 +1786,6 @@ __ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValue
 __ZN3JSC10makeStringINS_7UStringES1_EES1_T_T0_
 __ZN3JSC13tryMakeStringINS_7UStringES1_EEN3WTF10PassRefPtrIN7WebCore10StringImplEEET_T0_
 __ZN3JSC23MacroAssemblerX86Common8branch16ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE9BaseIndexENS4_5Imm32E
-__Z22jsc_pcre_ucp_othercasej
 __ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index a816c97..c1de599 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -1,6 +1,6 @@
 # JavaScriptCore - Qt4 build info
 
-include(../../common.pri)
+include(../common.pri)
 
 VPATH += $$PWD
 
@@ -23,6 +23,7 @@ CONFIG(standalone_package): DEFINES *= NDEBUG
 JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD \
     $$PWD/.. \
+    $$PWD/../ThirdParty \
     $$PWD/assembler \
     $$PWD/bytecode \
     $$PWD/bytecompiler \
@@ -30,7 +31,6 @@ JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD/interpreter \
     $$PWD/jit \
     $$PWD/parser \
-    $$PWD/pcre \
     $$PWD/profiler \
     $$PWD/runtime \
     $$PWD/wtf \
@@ -90,7 +90,8 @@ defineTest(addJavaScriptCoreLib) {
         QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
         webkit2 {
             # FIXME Workaround for undefined reference linking issues until the build system gets redesigned
-            LIBS += -Wl,-whole-archive -l$$JAVASCRIPTCORE_TARGET -Wl,-no-whole-archive
+            mac: LIBS += -Wl,-all_load -l$$JAVASCRIPTCORE_TARGET -WL,-noall_load 
+            else: LIBS += -Wl,-whole-archive -l$$JAVASCRIPTCORE_TARGET -Wl,-no-whole-archive
         } else {
             LIBS += -l$$JAVASCRIPTCORE_TARGET
         }
@@ -113,3 +114,4 @@ defineTest(addJavaScriptCoreLib) {
 
     return(true)
 }
+
diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro
index 9d254b7..1b5e28a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pro
+++ b/Source/JavaScriptCore/JavaScriptCore.pro
@@ -1,6 +1,6 @@
 # JavaScriptCore - qmake build info
 CONFIG += building-libs
-include($$PWD/../../WebKit.pri)
+include($$PWD/../WebKit.pri)
 include(JavaScriptCore.pri)
 
 TEMPLATE = lib
@@ -65,7 +65,7 @@ wince* {
     SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
 }
 
-include(pcre/pcre.pri)
+include(yarr/yarr.pri)
 include(wtf/wtf.pri)
 
 INSTALLDEPS += all
@@ -115,6 +115,7 @@ SOURCES += \
     parser/Nodes.cpp \
     parser/ParserArena.cpp \
     parser/Parser.cpp \
+    parser/SourceProviderCache.cpp \
     profiler/Profile.cpp \
     profiler/ProfileGenerator.cpp \
     profiler/ProfileNode.cpp \
@@ -127,6 +128,7 @@ SOURCES += \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
     runtime/CallData.cpp \
+    runtime/MarkedBlock.cpp \
     runtime/MarkedSpace.cpp \
     runtime/Heap.cpp \
     runtime/CommonIdentifiers.cpp \
@@ -179,6 +181,7 @@ SOURCES += \
     runtime/MarkStackPosix.cpp \
     runtime/MarkStackSymbian.cpp \
     runtime/MarkStackWin.cpp \
+    runtime/ConservativeSet.cpp \
     runtime/MarkStack.cpp \
     runtime/MathObject.cpp \
     runtime/NativeErrorConstructor.cpp \
@@ -210,10 +213,7 @@ SOURCES += \
     runtime/Structure.cpp \
     runtime/TimeoutChecker.cpp \
     runtime/UString.cpp \
-    yarr/YarrPattern.cpp \
-    yarr/YarrInterpreter.cpp \
     yarr/YarrJIT.cpp \
-    yarr/YarrSyntaxChecker.cpp
 
 # Generated files, simply list them for JavaScriptCore
 
@@ -226,5 +226,7 @@ symbian: {
     }
     QMAKE_CXXFLAGS.ARMCC += -OTime -O3
 }
+
 # Disable C++0x mode in JSC for those who enabled it in their Qt's mkspec
 *-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
+
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index 1f83397..68075f9 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -1,7 +1,7 @@
-!IF !defined(BUILDSTYLE)
-BUILDSTYLE=Release
-!ELSEIF "$(BUILDSTYLE)"=="DEBUG"
+!IF defined(BUILDSTYLE) && "$(BUILDSTYLE)"=="DEBUG"
 BUILDSTYLE=Debug_All
+!ELSE
+BUILDSTYLE=Release_PGO
 !ENDIF
 
 install:
@@ -9,30 +9,29 @@ install:
     set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
     set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
-    set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\ 
-!IF "$(BUILDSTYLE)"=="Release"
-    BUILDSTYLE=Release_PGO
+    set WebKitVSPropsRedirectionDir=$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\4\ 
+!IF "$(BUILDSTYLE)"=="Release_PGO"
     devenv "JavaScriptCoreSubmit.sln" /rebuild $(BUILDSTYLE)
     set PATH=$(SYSTEMDRIVE)\cygwin\bin;$(PATH)
-    xcopy "$(SRCROOT)\AppleInternal\tests\SunSpider\*" "$(ConfigurationBuildDir)\tests\SunSpider" /e/v/i/h/y
-    cd "$(ConfigurationBuildDir)\tests\SunSpider"
+    xcopy "$(SRCROOT)\AppleInternal\tests\SunSpider\*" "%ConfigurationBuildDir%\tests\SunSpider" /e/v/i/h/y
+    cd "%ConfigurationBuildDir%\tests\SunSpider"
     perl sunspider --shell ../../bin/jsc.exe --runs 3
-    del "$(ConfigurationBuildDir)\bin\JavaScriptCore.dll"
+    del "%ConfigurationBuildDir%\bin\JavaScriptCore.dll"
     cd "$(SRCROOT)\JavaScriptCore.vcproj"
     devenv "JavaScriptCoreSubmit.sln" /build Release_PGO_Optimize
 !ELSE
     devenv "JavaScriptCoreSubmit.sln" /rebuild $(BUILDSTYLE)
 !ENDIF
-    -xcopy "$(ConfigurationBuildDir)\bin\JavaScriptCore.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\JavaScriptCore_debug.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\JavaScriptCore.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\JavaScriptCore_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\jsc.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\jsc_debug.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\jsc.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    -xcopy "$(ConfigurationBuildDir)\bin\jsc_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
-    xcopy "$(ConfigurationBuildDir)\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y    
-    xcopy "$(ConfigurationBuildDir)\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y    
-    xcopy "$(ConfigurationBuildDir)\bin\JavaScriptCore.resources\*" "$(DSTROOT)\AppleInternal\bin\JavaScriptCore.resources" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\JavaScriptCore.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\JavaScriptCore_debug.dll" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\JavaScriptCore.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\JavaScriptCore_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\jsc.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\jsc_debug.exe" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\jsc.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    -xcopy "%ConfigurationBuildDir%\bin\jsc_debug.pdb" "$(DSTROOT)\AppleInternal\bin\" /e/v/i/h/y
+    xcopy "%ConfigurationBuildDir%\include\*" "$(DSTROOT)\AppleInternal\include\" /e/v/i/h/y    
+    xcopy "%ConfigurationBuildDir%\lib\*" "$(DSTROOT)\AppleInternal\lib\" /e/v/i/h/y    
+    xcopy "%ConfigurationBuildDir%\bin\JavaScriptCore.resources\*" "$(DSTROOT)\AppleInternal\bin\JavaScriptCore.resources" /e/v/i/h/y
     -mkdir "$(DSTROOT)\AppleInternal\Sources\JavaScriptCore"
-    xcopy "$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\*" "$(DSTROOT)\AppleInternal\Sources\JavaScriptCore" /e/v/i/h/y
+    xcopy "%ConfigurationBuildDir%\obj\JavaScriptCore\DerivedSources\*" "$(DSTROOT)\AppleInternal\Sources\JavaScriptCore" /e/v/i/h/y
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 4ddad24..010db39 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -9,8 +9,8 @@ EXPORTS
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
     ??0DynamicGlobalObjectScope@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@@Z
     ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
+    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z  
     ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
-    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z
     ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
     ??0JSFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I_J0@Z@Z
     ??0JSObjectWithGlobalObject@JSC@@IAE@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
@@ -26,6 +26,7 @@ EXPORTS
     ??0UString@JSC@@QAE@PBDI@Z
     ??0UString@JSC@@QAE@PB_WI@Z
     ??0WTFThreadData@WTF@@QAE@XZ
+    ??0YarrPattern@Yarr@JSC@@QAE@ABVUString@2@_N1PAPBD@Z
     ??1ClientData@JSGlobalData@JSC@@UAE@XZ
     ??1Collator@WTF@@QAE@XZ
     ??1Debugger@JSC@@UAE@XZ
@@ -35,6 +36,7 @@ EXPORTS
     ??1Mutex@WTF@@QAE@XZ
     ??1RefCountedLeakCounter@WTF@@QAE@XZ
     ??1RegExp@JSC@@QAE@XZ
+    ??1SourceProviderCache@JSC@@QAE@XZ
     ??1Structure@JSC@@QAE@XZ
     ??1ThreadCondition@WTF@@QAE@XZ
     ??1WTFThreadData@WTF@@QAE@XZ
@@ -42,6 +44,7 @@ EXPORTS
     ??8JSC@@YA_NABVUString@0@0@Z
     ??8WTF@@YA_NABVCString@0@0@Z
     ?NaN@JSC@@3NB
+    ?absoluteTimeToWaitTimeoutInterval@WTF@@YAKN@Z
     ?add@Identifier@JSC@@SA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PBD@Z
     ?add@PropertyNameArray@JSC@@QAEXPAVStringImpl@WTF@@@Z
     ?addBytes@MD5@WTF@@QAEXPBEI@Z
@@ -59,7 +62,10 @@ EXPORTS
     ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
     ?broadcast@ThreadCondition@WTF@@QAEXXZ
     ?bufferLengthForStringDecimal@DecimalNumber@WTF@@QBEIXZ
+    ?byteCompile@Yarr@JSC@@YA?AV?$PassOwnPtr@UBytecodePattern@Yarr@JSC@@@WTF@@AAUYarrPattern@12@PAVBumpPointerAllocator@4@@Z
+    ?byteSize@SourceProviderCache@JSC@@QBEIXZ
     ?calculateDSTOffset@WTF@@YANNN@Z
+    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBDAAI1@Z
     ?calculateStringHashFromUTF8@Unicode@WTF@@YAIPBD0AAI@Z
     ?calculateUTCOffset@WTF@@YAHXZ
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
@@ -67,6 +73,7 @@ EXPORTS
     ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z
     ?cancelCallOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
+    ?capacity@Heap@JSC@@QBEIXZ
     ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@@Z
@@ -75,6 +82,7 @@ EXPORTS
     ?classInfo@InternalFunction@JSC@@UBEPBUClassInfo@2@XZ
     ?classInfo@JSCell@JSC@@UBEPBUClassInfo@2@XZ
     ?className@JSObject@JSC@@UBE?AVUString@2@XZ
+    ?clear@SourceProviderCache@JSC@@QAEXXZ
     ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
     ?collectAllGarbage@Heap@JSC@@QAEXXZ
     ?configurable@PropertyDescriptor@JSC@@QBE_NXZ
@@ -94,6 +102,7 @@ EXPORTS
     ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
     ?createInterruptedExecutionException@JSC@@YAPAVJSObject@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@@Z
+    ?createRangeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
@@ -103,6 +112,7 @@ EXPORTS
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
     ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z
     ?currentThread@WTF@@YAIXZ
     ?currentTime@WTF@@YANXZ
     ?data@CString@WTF@@QBEPBDXZ
@@ -152,7 +162,7 @@ EXPORTS
     ?fastRealloc@WTF@@YAPAXPAXI@Z
     ?fastStrDup@WTF@@YAPADPBD@Z
     ?fastZeroedMalloc@WTF@@YAPAXI@Z
-    ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
+    ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAV?$WriteBarrierBase@W4Unknown@JSC@@@2@@Z
     ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?free@WeakGCHandlePool@JSC@@QAEXPAVWeakGCHandle@2@@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z
@@ -202,6 +212,7 @@ EXPORTS
     ?initializeMainThread@WTF@@YAXXZ
     ?initializeThreading@JSC@@YAXXZ
     ?initializeThreading@WTF@@YAXXZ
+    ?interpret@Yarr@JSC@@YAHPAUBytecodePattern@12@PB_WIIPAH@Z
     ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isBusy@Heap@JSC@@QAE_NXZ
     ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
@@ -213,9 +224,6 @@ EXPORTS
     ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
     ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
     ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
-    ?jsRegExpCompile@@YAPAUJSRegExp@@PB_WHW4JSRegExpIgnoreCaseOption@@W4JSRegExpMultilineOption@@PAIPAPBD@Z
-    ?jsRegExpExecute@@YAHPBUJSRegExp@@PB_WHHPAHH@Z
-    ?jsRegExpFree@@YAXPAUJSRegExp@@@Z
     ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?length@CString@WTF@@QBEIXZ
     ?lock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
@@ -246,7 +254,7 @@ EXPORTS
     ?protect@Heap@JSC@@QAEXVJSValue@2@@Z
     ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ
     ?protectedObjectCount@Heap@JSC@@QAEIXZ
-    ?protectedObjectTypeCounts@Heap@JSC@@QAEPAV?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@XZ
+    ?protectedObjectTypeCounts@Heap@JSC@@QAE?AV?$PassOwnPtr@V?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@@WTF@@XZ
     ?put@JSCell@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?put@JSCell@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
     ?put@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
@@ -264,10 +272,10 @@ EXPORTS
     ?putWithAttributes@JSObject@JSC@@UAEXPAVJSGlobalData@2@IVJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
-    ?recordExtraCost@Heap@JSC@@AAEXI@Z
     ?reifyString@StringBuilder@WTF@@AAEXXZ
     ?releaseDecommitted@OSAllocator@WTF@@SAXPAXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
+    ?reportExtraMemoryCostSlowCase@Heap@JSC@@AAEXI@Z
     ?reserveAndCommit@OSAllocator@WTF@@SAPAXIW4Usage@12@_N1@Z
     ?reset@ParserArena@JSC@@QAEXXZ
     ?reset@TimeoutChecker@JSC@@QAEXXZ
@@ -358,4 +366,5 @@ EXPORTS
     WTFReportArgumentAssertionFailure
     WTFReportAssertionFailure
     WTFReportAssertionFailureWithMessage
+    WTFReportBacktrace
     WTFReportError
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 12310d8..260779e 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -594,15 +594,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\MarkedSpace.cpp"
+				RelativePath="..\..\runtime\MarkedBlock.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\MarkedSpace.h"
+				RelativePath="..\..\runtime\MarkedBlock.h"
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\CollectorHeapIntrospector.h"
+				RelativePath="..\..\runtime\MarkedSpace.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\runtime\MarkedSpace.h"
 				>
 			</File>
 			<File
@@ -1002,6 +1006,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\runtime\ConservativeSet.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\runtime\ConservativeSet.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\runtime\MarkStack.cpp"
 				>
 			</File>
@@ -1323,42 +1335,6 @@
 			</File>
 		</Filter>
 		<Filter
-			Name="pcre"
-			>
-			<File
-				RelativePath="..\..\pcre\pcre.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_compile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_exec.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_internal.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_tables.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_ucp_searchfuncs.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\pcre_xclass.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\pcre\ucpinternal.h"
-				>
-			</File>
-		</Filter>
-		<Filter
 			Name="API"
 			>
 			<File
@@ -1946,6 +1922,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\parser\SourceProviderCache.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\parser\SourceProviderCache.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\parser\SourceProviderCacheItem.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\parser\SyntaxChecker.h"
 				>
 			</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index 2a85beb..4a7f4d3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 	/>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index 65e3215..314a794 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -1,58 +1,60 @@
 all:
-    touch "$(CONFIGURATIONBUILDDIR)\buildfailed"
-    bash build-generated-files.sh "$(CONFIGURATIONBUILDDIR)" "$(WEBKITLIBRARIESDIR)"
-    -bash -c "python react-to-vsprops-changes.py"
-    -mkdir 2>NUL "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\APICast.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScript.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSBase.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRef.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRefPrivate.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRef.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRefPrivate.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRef.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefCF.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefBSTR.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSValueRef.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScriptCore.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefInternal.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefPrivate.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\OpaqueJSString.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\WebKitAvailability.h" "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore"
+    touch "%ConfigurationBuildDir%\buildfailed"
+    bash build-generated-files.sh "%ConfigurationBuildDir%" "$(WEBKITLIBRARIESDIR)"
+!IF "$(PRODUCTION)"!="1"
+    bash -c "python react-to-vsprops-changes.py"
+!ENDIF
+    -mkdir 2>NUL "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\APICast.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JavaScript.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSBase.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSContextRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSContextRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSObjectRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSObjectRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSStringRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSStringRefCF.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSStringRefBSTR.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSValueRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JavaScriptCore.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSWeakObjectMapRefInternal.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSWeakObjectMapRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\OpaqueJSString.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
+    xcopy /y /d "..\..\API\WebKitAvailability.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
     
-    -mkdir 2>NUL "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
+    -mkdir 2>NUL "%ConfigurationBuildDir%\include\private\JavaScriptCore"
 
-    xcopy /y /d "..\..\wtf\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\icu\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\parser\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\runtime\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\bytecode\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\interpreter\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\assembler\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\jit\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\debugger\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\profiler\*.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\create_hash_table" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\pcre\pcre.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\AtomicString.cpp" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringBuilder.cpp" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringImpl.cpp" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\WTFString.cpp" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\unicode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\unicode\icu\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\parser\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\runtime\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\bytecode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\interpreter\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\assembler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\jit\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\debugger\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\profiler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\create_hash_table" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\AtomicString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\StringBuilder.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\StringImpl.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\WTFString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\yarr\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
 
 
-    -mkdir 2>NUL "$(CONFIGURATIONBUILDDIR)\bin\JavaScriptCore.resources"
-    xcopy /y /d "..\JavaScriptCore.resources\*" "$(CONFIGURATIONBUILDDIR)\bin\JavaScriptCore.resources"
+    -mkdir 2>NUL "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
+    xcopy /y /d "..\JavaScriptCore.resources\*" "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
     
-    -del "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore\stdbool.h" "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore\stdint.h"
-    -del "$(CONFIGURATIONBUILDDIR)\buildfailed"
+    -del "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdbool.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdint.h"
+    -del "%ConfigurationBuildDir%\buildfailed"
 
 clean:
-    -del "$(CONFIGURATIONBUILDDIR)\buildfailed"
-    -del /s /q "$(CONFIGURATIONBUILDDIR)\include\JavaScriptCore\JavaScriptCore"
-    -del /s /q "$(CONFIGURATIONBUILDDIR)\obj\JavaScriptCore\DerivedSources"
-    -del /s /q "$(CONFIGURATIONBUILDDIR)\include\private\JavaScriptCore"
-    -del /s /q "$(CONFIGURATIONBUILDDIR)\bin\JavaScriptCore.resources"
+    -del "%ConfigurationBuildDir%\buildfailed"
+    -del /s /q "%ConfigurationBuildDir%\include\JavaScriptCore\JavaScriptCore"
+    -del /s /q "%ConfigurationBuildDir%\obj\JavaScriptCore\DerivedSources"
+    -del /s /q "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    -del /s /q "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index b8383c4..2437071 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -87,6 +87,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\DerivedSources.make"
+			>
+		</File>
+		<File
 			RelativePath=".\JavaScriptCoreGenerated.make"
 			>
 		</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
index ab1df83..e12840f 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
@@ -19,11 +19,14 @@ def main():
     # Delete any manifest-related files because Visual Studio isn't smart
     # enough to figure out that it might need to rebuild them.
     obj_directory = os.path.join(os.environ['CONFIGURATIONBUILDDIR'], 'obj')
-    for manifest_file in glob.iglob(os.path.join(obj_directory, '*', '*', '*.manifest*')):
-        manifest_time = os.path.getmtime(manifest_file)
-        if manifest_time < newest_vsprops_time:
-            print 'Deleting %s' % manifest_file
-            os.remove(manifest_file)
+    for manifest_file in glob.iglob(os.path.join(obj_directory, '*', '*.manifest*')):
+        delete_if_older_than(manifest_file, newest_vsprops_time)
+
+    # Delete any precompiled headers because Visual Studio isn't smart enough
+    # to figure out that it might need to rebuild them, even if we touch
+    # wtf/Platform.h below.
+    for precompiled_header in glob.iglob(os.path.join(obj_directory, '*', '*.pch')):
+        delete_if_older_than(precompiled_header, newest_vsprops_time)
 
     # Touch wtf/Platform.h so all files will be recompiled. This is necessary
     # to pick up changes to preprocessor macros (e.g., ENABLE_*).
@@ -33,5 +36,11 @@ def main():
         os.utime(wtf_platform_h, None)
 
 
+def delete_if_older_than(path, reference_time):
+    if os.path.getmtime(path) < reference_time:
+        print 'Deleting %s' % path
+        os.remove(path)
+
+
 if __name__ == '__main__':
     sys.exit(main())
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 457392d..55371f3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -400,6 +400,10 @@
 			Name="unicode"
 			>
 			<File
+				RelativePath="..\..\wtf\unicode\CharacterNames.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\wtf\unicode\Collator.h"
 				>
 			</File>
@@ -533,6 +537,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\BloomFilter.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\BumpPointerAllocator.h"
 			>
 		</File>
@@ -553,6 +561,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\CryptographicallyRandomNumber.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\CryptographicallyRandomNumber.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\CurrentTime.cpp"
 			>
 		</File>
@@ -745,11 +761,15 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\OwnArrayPtr.h"
+			RelativePath="..\..\wtf\OSRandomSource.cpp"
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\OwnArrayPtrCommon.h"
+			RelativePath="..\..\wtf\OSRandomSource.h"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\OwnArrayPtr.h"
 			>
 		</File>
 		<File
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
index b74b939..6e2321f 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../parser/;../../wtf/;../../wtf/unicode/;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;../../../icu/include;../../bindings;../../bindings/c;../../bindings/jni;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 		ProgramDataBaseFileName="$(OutDir)\$(TargetName).vc80.pdb"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index d1c3638..3e329c3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../pcre/;../../assembler/;../../API/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 		ForcedUsingFiles=""
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 358e38c..74e3b43 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -122,6 +122,7 @@
 		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
 		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
+		146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */; };
 		146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146FE51111A710430087AE66 /* JITCall32_64.cpp */; };
 		147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */; };
 		147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -175,8 +176,9 @@
 		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
 		14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A6581A0F4E36F4000150FD /* JITStubs.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14C824AB12F7C77E008F35E0 /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */; };
+		14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C824AC12F7C785008F35E0 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
-		14F3488F0E95EF8A003648BC /* CollectorHeapIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */; settings = {ATTRIBUTES = (); }; };
 		14F8BA3E107EC886009892DC /* FastMalloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */; };
 		14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */; };
 		14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */; };
@@ -187,12 +189,13 @@
 		18BAB55410DAE066000D945B /* ThreadIdentifierDataPthreads.h in Headers */ = {isa = PBXBuildFile; fileRef = 18BAB52810DADFCD000D945B /* ThreadIdentifierDataPthreads.h */; };
 		1C61516C0EBAC7A00031376F /* ProfilerServer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C61516A0EBAC7A00031376F /* ProfilerServer.mm */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
 		1C61516D0EBAC7A00031376F /* ProfilerServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1C61516B0EBAC7A00031376F /* ProfilerServer.h */; };
+		2CFC5D1E12F45B48004914E2 /* CharacterNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 2CFC5B7A12F44714004914E2 /* CharacterNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41359CF30FDD89AD00206180 /* DateConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateConversion.h */; };
 		41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41359CF40FDD89CB00206180 /* DateMath.cpp */; };
 		41359CF70FDD89CB00206180 /* DateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 41359CF50FDD89CB00206180 /* DateMath.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 44DD48520FAEA85000D6B4EB /* PassOwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		451539B912DC994500EF7AC4 /* Yarr.h in Headers */ = {isa = PBXBuildFile; fileRef = 451539B812DC994500EF7AC4 /* Yarr.h */; };
+		451539B912DC994500EF7AC4 /* Yarr.h in Headers */ = {isa = PBXBuildFile; fileRef = 451539B812DC994500EF7AC4 /* Yarr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511FC4C9117EE28700425272 /* MD5.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511FC4C7117EE23D00425272 /* MD5.cpp */; };
 		511FC4CB117EE2A800425272 /* MD5.h in Headers */ = {isa = PBXBuildFile; fileRef = 511FC4CA117EE2A800425272 /* MD5.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5135FAF212D26ACE003C083B /* Decoder.h in Headers */ = {isa = PBXBuildFile; fileRef = 5135FAD512D26856003C083B /* Decoder.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -228,12 +231,12 @@
 		86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */; };
 		86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */; };
 		86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B7D12DBA33700A9FE7B /* YarrInterpreter.cpp */; };
-		86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B7E12DBA33700A9FE7B /* YarrInterpreter.h */; };
+		86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B7E12DBA33700A9FE7B /* YarrInterpreter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B7F12DBA33700A9FE7B /* YarrJIT.cpp */; };
-		86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8012DBA33700A9FE7B /* YarrJIT.h */; };
-		86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8112DBA33700A9FE7B /* YarrParser.h */; };
+		86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8012DBA33700A9FE7B /* YarrJIT.h */; settings = {ATTRIBUTES = (); }; };
+		86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8112DBA33700A9FE7B /* YarrParser.h */; settings = {ATTRIBUTES = (); }; };
 		86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B8212DBA33700A9FE7B /* YarrPattern.cpp */; };
-		86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8312DBA33700A9FE7B /* YarrPattern.h */; };
+		86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8312DBA33700A9FE7B /* YarrPattern.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		868BFA08117CEFD100B908B1 /* AtomicString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 868BFA00117CEFD100B908B1 /* AtomicString.cpp */; };
 		868BFA09117CEFD100B908B1 /* AtomicString.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA01117CEFD100B908B1 /* AtomicString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		868BFA0A117CEFD100B908B1 /* AtomicStringImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA02117CEFD100B908B1 /* AtomicStringImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -283,9 +286,6 @@
 		90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 90D3469B0E285280009492EE /* RefCountedLeakCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
 		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (); }; };
-		930754C108B0F68000AB3056 /* pcre_compile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754BF08B0F68000AB3056 /* pcre_compile.cpp */; };
-		930754D008B0F74600AB3056 /* pcre_tables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754CE08B0F74500AB3056 /* pcre_tables.cpp */; };
-		930754EB08B0F78500AB3056 /* pcre_exec.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 930754E908B0F78500AB3056 /* pcre_exec.cpp */; settings = {COMPILER_FLAGS = "-fno-move-loop-invariants"; }; };
 		932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
 		932F5BD50822A1C700736975 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
 		932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */; };
@@ -296,9 +296,7 @@
 		9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93303FE80E6A72B500786E6A /* SmallStrings.cpp */; };
 		9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */; };
 		933F5CDC1269229B0049191E /* NullPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 933F5CDB126922690049191E /* NullPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		937013480CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */; settings = {COMPILER_FLAGS = "-Wno-sign-compare"; }; };
 		93854A9A12C93D3B00DAAF77 /* NullPtr.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93854A9912C93D3B00DAAF77 /* NullPtr.cpp */; };
-		93E26BD408B1514100F85226 /* pcre_xclass.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E26BD308B1514100F85226 /* pcre_xclass.cpp */; };
 		9534AAFB0E5B7A9600B8A45B /* JSProfilerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 952C63AC0E4777D600C13936 /* JSProfilerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		95742F650DD11F5A000917FB /* Profile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95742F630DD11F5A000917FB /* Profile.cpp */; };
 		95AB83420DA4322500BC83F3 /* Profiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 95AB832E0DA42CAD00BC83F3 /* Profiler.cpp */; };
@@ -334,6 +332,10 @@
 		971EDEA61169E0D3005E4262 /* Terminator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97F6903A1169DF7F00A6BB46 /* Terminator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		972A485F12661E0800F4514F /* URLCharacterTypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A485D12661E0800F4514F /* URLCharacterTypes.cpp */; };
 		972A48771266256F00F4514F /* URLEscape.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A48741266256F00F4514F /* URLEscape.cpp */; };
+		97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A3F130299DB004A3447 /* OSRandomSource.cpp */; };
+		97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 97941A40130299DB004A3447 /* OSRandomSource.h */; };
+		97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */; };
+		97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 97941A7D1302A098004A3447 /* CryptographicallyRandomNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
 		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -371,6 +373,7 @@
 		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
 		A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */; };
 		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
 		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
 		A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F19ECD11DD490900931E70 /* FixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -473,8 +476,6 @@
 		BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 9303F567099118FA00AD71B8 /* OwnPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F0B3AA09BB4DC00068FCE3 /* Parser.h */; settings = {ATTRIBUTES = (); }; };
 		BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 6580F795094070560082C219 /* PassRefPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C44D0E16F5CD00B34460 /* pcre.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541720F039E08B90058BFEB /* pcre.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C44E0E16F5CD00B34460 /* pcre_internal.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E26BE508B1517100F85226 /* pcre_internal.h */; };
 		BC18C44F0E16F5CD00B34460 /* Platform.h in Headers */ = {isa = PBXBuildFile; fileRef = 65D6D87E09B5A32E0002E4D7 /* Platform.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4500E16F5CD00B34460 /* Profile.h in Headers */ = {isa = PBXBuildFile; fileRef = 95742F640DD11F5A000917FB /* Profile.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4510E16F5CD00B34460 /* ProfileNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 95AB83550DA43B4400BC83F3 /* ProfileNode.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -505,7 +506,6 @@
 		BC18C46F0E16F5CD00B34460 /* TCSystemAlloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */; };
 		BC18C4700E16F5CD00B34460 /* Threading.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE79220D6C95CD00FEA3BA /* Threading.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4720E16F5CD00B34460 /* ucpinternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E26BFC08B151D400F85226 /* ucpinternal.h */; };
 		BC18C4730E16F5CD00B34460 /* Unicode.h in Headers */ = {isa = PBXBuildFile; fileRef = E195679409E7CF1200B89D13 /* Unicode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */ = {isa = PBXBuildFile; fileRef = E195678F09E7CF1200B89D13 /* UnicodeIcu.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */ = {isa = PBXBuildFile; fileRef = 935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -547,7 +547,6 @@
 		BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE3AB00E6C82CF001453A7 /* Structure.cpp */; };
 		BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFBE696122560E800309E9D /* PassOwnArrayPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFBE695122560E800309E9D /* PassOwnArrayPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BCFBE698122561D200309E9D /* OwnArrayPtrCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFBE697122561D200309E9D /* OwnArrayPtrCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
 		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; };
 		C0A272630E50A06300E96E15 /* NotFound.h in Headers */ = {isa = PBXBuildFile; fileRef = C0A2723F0E509F1E00E96E15 /* NotFound.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -570,6 +569,10 @@
 		E1EE793D0D6C9B9200FEA3BA /* ThreadingPthreads.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */; };
 		E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1EF79A80CE97BA60088D500 /* UTF8.cpp */; };
 		E48E0F2D0F82151700A8CA37 /* FastAllocBase.h in Headers */ = {isa = PBXBuildFile; fileRef = E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
+		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; };
+		E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D8CE9B12FC42E100BC9F5A /* BloomFilter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F3BD31ED126735770065467F /* TextPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = F3BD31D0126730180065467F /* TextPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FDA15C1E12B0305C003A583A /* Complex.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA15C1612B03028003A583A /* Complex.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE1B447A0ECCD73B004F4DD1 /* StdLibExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1B44790ECCD73B004F4DD1 /* StdLibExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -708,6 +711,7 @@
 		145C507F0D9DF63B0088F6B9 /* CallData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallData.h; sourceTree = "<group>"; };
 		146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSStringRefCF.h; sourceTree = "<group>"; };
 		146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRefCF.cpp; sourceTree = "<group>"; };
+		146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeSet.cpp; sourceTree = "<group>"; };
 		146FE51111A710430087AE66 /* JITCall32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall32_64.cpp; sourceTree = "<group>"; };
 		14760863099C633800437128 /* JSImmediate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImmediate.cpp; sourceTree = "<group>"; };
 		147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BatchedTransitionOptimizer.h; sourceTree = "<group>"; };
@@ -725,6 +729,7 @@
 		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
 		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
+		149DAAF212EB559D0083B12B /* ConservativeSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeSet.h; sourceTree = "<group>"; };
 		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
 		14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubs.cpp; sourceTree = "<group>"; };
 		14A396A60CD2933100B5B4FF /* SymbolTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolTable.h; sourceTree = "<group>"; };
@@ -746,13 +751,14 @@
 		14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSValueRef.cpp; sourceTree = "<group>"; };
 		14BD5A2D0A3E91F600BAF59C /* testapi.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = testapi.c; path = API/tests/testapi.c; sourceTree = "<group>"; };
 		14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMap.h; sourceTree = "<group>"; };
+		14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
+		14C824AC12F7C785008F35E0 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
 		14D792640DAA03FB001A9F05 /* RegisterFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterFile.h; sourceTree = "<group>"; };
 		14D857740A4696C80032146C /* testapi.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = testapi.js; path = API/tests/testapi.js; sourceTree = "<group>"; };
 		14DA818E0D99FD2000B0A4FB /* JSActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSActivation.h; sourceTree = "<group>"; };
 		14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSActivation.cpp; sourceTree = "<group>"; };
 		14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObject.cpp; sourceTree = "<group>"; };
 		14F252560D08DD8D004ECFFF /* JSVariableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVariableObject.h; sourceTree = "<group>"; };
-		14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectorHeapIterator.h; sourceTree = "<group>"; };
 		14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageAllocationAligned.cpp; sourceTree = "<group>"; };
 		14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageAllocationAligned.h; sourceTree = "<group>"; };
 		180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CurrentTime.cpp; sourceTree = "<group>"; };
@@ -767,6 +773,7 @@
 		1C9051450BA9E8A70081E9D0 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
 		1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScript.h; sourceTree = "<group>"; };
 		1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCore.h; sourceTree = "<group>"; };
+		2CFC5B7A12F44714004914E2 /* CharacterNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CharacterNames.h; sourceTree = "<group>"; };
 		41359CF40FDD89CB00206180 /* DateMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateMath.cpp; sourceTree = "<group>"; };
 		41359CF50FDD89CB00206180 /* DateMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateMath.h; sourceTree = "<group>"; };
 		440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnPtrCommon.h; sourceTree = "<group>"; };
@@ -797,7 +804,6 @@
 		652246A40C8D7A0E007BDAF7 /* HashIterators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashIterators.h; sourceTree = "<group>"; };
 		65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyNameArray.cpp; sourceTree = "<group>"; };
 		65400C100A69BAF200509887 /* PropertyNameArray.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PropertyNameArray.h; sourceTree = "<group>"; };
-		6541720F039E08B90058BFEB /* pcre.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = pcre.h; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD6E08E80A17002CBEE7 /* TCPageMap.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = TCPageMap.h; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = TCSpinLock.h; sourceTree = "<group>"; tabWidth = 8; };
 		6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TCSystemAlloc.cpp; sourceTree = "<group>"; tabWidth = 8; };
@@ -811,7 +817,6 @@
 		6580F795094070560082C219 /* PassRefPtr.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = PassRefPtr.h; sourceTree = "<group>"; tabWidth = 8; };
 		6592C316098B7DE10003D4F6 /* Vector.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Vector.h; sourceTree = "<group>"; };
 		6592C317098B7DE10003D4F6 /* VectorTraits.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = VectorTraits.h; sourceTree = "<group>"; };
-		65B174BE09D1000200820339 /* chartables.c */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.c; fileEncoding = 30; path = chartables.c; sourceTree = "<group>"; };
 		65C02FBB0637462A003E7EE6 /* Protect.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Protect.h; sourceTree = "<group>"; tabWidth = 8; };
 		65C647B3093EF8D60022C380 /* RefPtr.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RefPtr.h; sourceTree = "<group>"; tabWidth = 8; };
 		65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSWrapperObject.cpp; sourceTree = "<group>"; };
@@ -862,7 +867,6 @@
 		86704B8212DBA33700A9FE7B /* YarrPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrPattern.cpp; path = yarr/YarrPattern.cpp; sourceTree = "<group>"; };
 		86704B8312DBA33700A9FE7B /* YarrPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrPattern.h; path = yarr/YarrPattern.h; sourceTree = "<group>"; };
 		867FC35F11B763950025105E /* JavaScriptCore.JSVALUE32_64only.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = JavaScriptCore.JSVALUE32_64only.exp; sourceTree = "<group>"; };
-		867FC36011B763950025105E /* JavaScriptCore.JSVALUE32only.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = JavaScriptCore.JSVALUE32only.exp; sourceTree = "<group>"; };
 		867FC36111B763950025105E /* JavaScriptCore.JSVALUE64only.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = JavaScriptCore.JSVALUE64only.exp; sourceTree = "<group>"; };
 		868BFA00117CEFD100B908B1 /* AtomicString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AtomicString.cpp; path = text/AtomicString.cpp; sourceTree = "<group>"; };
 		868BFA01117CEFD100B908B1 /* AtomicString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AtomicString.h; path = text/AtomicString.h; sourceTree = "<group>"; };
@@ -916,9 +920,6 @@
 		9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnArrayPtr.h; sourceTree = "<group>"; };
 		93052C320FB792190048FDC3 /* ParserArena.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ParserArena.cpp; sourceTree = "<group>"; };
 		93052C330FB792190048FDC3 /* ParserArena.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserArena.h; sourceTree = "<group>"; };
-		930754BF08B0F68000AB3056 /* pcre_compile.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_compile.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		930754CE08B0F74500AB3056 /* pcre_tables.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_tables.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		930754E908B0F78500AB3056 /* pcre_exec.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_exec.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		930DAD030FB1EB1A0082D205 /* NodeConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeConstructors.h; sourceTree = "<group>"; };
 		9322A00306C341D3009067BB /* libicucore.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libicucore.dylib; path = /usr/lib/libicucore.dylib; sourceTree = "<absolute>"; };
 		932F5BD80822A1C700736975 /* Info.plist */ = {isa = PBXFileReference; indentWidth = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; tabWidth = 8; usesTabs = 1; };
@@ -933,7 +934,6 @@
 		933F5CDB126922690049191E /* NullPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullPtr.h; sourceTree = "<group>"; };
 		935AF46909E9D9DB00ACD1D8 /* Forward.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Forward.h; sourceTree = "<group>"; };
 		935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnusedParam.h; sourceTree = "<group>"; };
-		937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_ucp_searchfuncs.cpp; sourceTree = "<group>"; };
 		9374D3A7038D9D74008635CE /* ScopeChain.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChain.h; sourceTree = "<group>"; tabWidth = 8; };
 		9374D3A8038D9D74008635CE /* ScopeChain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScopeChain.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		937B63CC09E766D200A671DD /* DerivedSources.make */ = {isa = PBXFileReference; explicitFileType = sourcecode.make; fileEncoding = 4; path = DerivedSources.make; sourceTree = "<group>"; usesTabs = 1; };
@@ -945,9 +945,6 @@
 		93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArray.cpp; sourceTree = "<group>"; };
 		93B6A0DE0AA64DA40076DE27 /* GetPtr.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = GetPtr.h; sourceTree = "<group>"; };
 		93CEDDFB0EA91EE600258EBE /* RegExpMatchesArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpMatchesArray.h; sourceTree = "<group>"; };
-		93E26BD308B1514100F85226 /* pcre_xclass.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_xclass.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		93E26BE508B1517100F85226 /* pcre_internal.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = pcre_internal.h; sourceTree = "<group>"; tabWidth = 8; };
-		93E26BFC08B151D400F85226 /* ucpinternal.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ucpinternal.h; sourceTree = "<group>"; tabWidth = 8; };
 		93F0B3A909BB4DC00068FCE3 /* Parser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Parser.cpp; sourceTree = "<group>"; };
 		93F0B3AA09BB4DC00068FCE3 /* Parser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Parser.h; sourceTree = "<group>"; };
 		93F1981A08245AAE001E9ABC /* Keywords.table */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = text; path = Keywords.table; sourceTree = "<group>"; tabWidth = 8; };
@@ -994,6 +991,10 @@
 		972A48741266256F00F4514F /* URLEscape.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = URLEscape.cpp; path = url/src/URLEscape.cpp; sourceTree = "<group>"; };
 		972A48751266256F00F4514F /* URLEscape.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLEscape.h; path = url/src/URLEscape.h; sourceTree = "<group>"; };
 		972A48761266256F00F4514F /* URLQueryCanonicalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLQueryCanonicalizer.h; path = url/src/URLQueryCanonicalizer.h; sourceTree = "<group>"; };
+		97941A3F130299DB004A3447 /* OSRandomSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OSRandomSource.cpp; sourceTree = "<group>"; };
+		97941A40130299DB004A3447 /* OSRandomSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OSRandomSource.h; sourceTree = "<group>"; };
+		97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CryptographicallyRandomNumber.cpp; sourceTree = "<group>"; };
+		97941A7D1302A098004A3447 /* CryptographicallyRandomNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CryptographicallyRandomNumber.h; sourceTree = "<group>"; };
 		97F6903A1169DF7F00A6BB46 /* Terminator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Terminator.h; sourceTree = "<group>"; };
 		A1712B3A11C7B212007A5315 /* RegExpCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCache.cpp; sourceTree = "<group>"; };
 		A1712B3E11C7B228007A5315 /* RegExpCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCache.h; sourceTree = "<group>"; };
@@ -1036,6 +1037,7 @@
 		A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess32_64.cpp; sourceTree = "<group>"; };
 		A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
 		A7D649A91015224E009B2E1B /* PossiblyNull.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PossiblyNull.h; sourceTree = "<group>"; };
+		A7DCB77912E3D90500911940 /* WriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrier.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
 		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
 		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
@@ -1121,6 +1123,7 @@
 		BC7952350E15EB5600A898AB /* BooleanPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.h; sourceTree = "<group>"; };
 		BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNumberCell.h; sourceTree = "<group>"; };
 		BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCell.cpp; sourceTree = "<group>"; };
+		BC8149AF12F89F53007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC87CDB810712ACA000614CF /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.lut.h; sourceTree = "<group>"; };
 		BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstructData.h; sourceTree = "<group>"; };
 		BC9041470EB9250900FE26FA /* StructureTransitionTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureTransitionTable.h; sourceTree = "<group>"; };
@@ -1147,7 +1150,6 @@
 		BCF605120E203EF800B9A64D /* ArgList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgList.h; sourceTree = "<group>"; };
 		BCF6553B0A2048DE0038A194 /* MathExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MathExtras.h; sourceTree = "<group>"; };
 		BCFBE695122560E800309E9D /* PassOwnArrayPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PassOwnArrayPtr.h; sourceTree = "<group>"; };
-		BCFBE697122561D200309E9D /* OwnArrayPtrCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnArrayPtrCommon.h; sourceTree = "<group>"; };
 		BCFD8C900EEB2EE700283848 /* JumpTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JumpTable.cpp; sourceTree = "<group>"; };
 		BCFD8C910EEB2EE700283848 /* JumpTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JumpTable.h; sourceTree = "<group>"; };
 		C0A2723F0E509F1E00E96E15 /* NotFound.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NotFound.h; sourceTree = "<group>"; };
@@ -1180,6 +1182,10 @@
 		E1EF79A80CE97BA60088D500 /* UTF8.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UTF8.cpp; sourceTree = "<group>"; };
 		E1EF79A90CE97BA60088D500 /* UTF8.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UTF8.h; sourceTree = "<group>"; };
 		E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FastAllocBase.h; sourceTree = "<group>"; };
+		E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
+		E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
+		E49DC15512EF277200184A1F /* SourceProviderCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceProviderCache.cpp; sourceTree = "<group>"; };
+		E4D8CE9B12FC42E100BC9F5A /* BloomFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BloomFilter.h; sourceTree = "<group>"; };
 		F3BD31D0126730180065467F /* TextPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextPosition.h; path = text/TextPosition.h; sourceTree = "<group>"; };
 		F5BB2BC5030F772101FCFE1D /* Completion.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Completion.h; sourceTree = "<group>"; tabWidth = 8; };
 		F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCorePrefix.h; sourceTree = "<group>"; tabWidth = 8; };
@@ -1288,7 +1294,6 @@
 				937B63CC09E766D200A671DD /* DerivedSources.make */,
 				F692A8540255597D01FF60F7 /* create_hash_table */,
 				14B8ECA60A5653980062BE54 /* JavaScriptCore.exp */,
-				867FC36011B763950025105E /* JavaScriptCore.JSVALUE32only.exp */,
 				867FC35F11B763950025105E /* JavaScriptCore.JSVALUE32_64only.exp */,
 				867FC36111B763950025105E /* JavaScriptCore.JSVALUE64only.exp */,
 				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
@@ -1302,7 +1307,6 @@
 				1429D77A0ED20D7300B89619 /* interpreter */,
 				1429D92C0ED22D7000B89619 /* jit */,
 				7E39D8370EC3A388003AF11A /* parser */,
-				65417203039E01F90058BFEB /* pcre */,
 				95AB831A0DA42C6900BC83F3 /* profiler */,
 				7EF6E0BB0EB7A1EC0079AFAF /* runtime */,
 				141211000A48772600480255 /* tests */,
@@ -1485,8 +1489,8 @@
 			isa = PBXGroup;
 			children = (
 				BC18C5230E16FC8A00B34460 /* ArrayPrototype.lut.h */,
-				65B174BE09D1000200820339 /* chartables.c */,
 				BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */,
+				BC8149AF12F89F53007B2C32 /* HeaderDetection.h */,
 				BC87CDB810712ACA000614CF /* JSONObject.lut.h */,
 				BC18C52D0E16FCE100B34460 /* Lexer.lut.h */,
 				BC18C5290E16FCC200B34460 /* MathObject.lut.h */,
@@ -1520,6 +1524,8 @@
 				A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */,
 				FDA15C1612B03028003A583A /* Complex.h */,
 				0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */,
+				97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */,
+				97941A7D1302A098004A3447 /* CryptographicallyRandomNumber.h */,
 				180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */,
 				180B9AF00F16C569009BDBC5 /* CurrentTime.h */,
 				41359CF40FDD89CB00206180 /* DateMath.cpp */,
@@ -1562,8 +1568,9 @@
 				933F5CDB126922690049191E /* NullPtr.h */,
 				1400067612A6F7830064D123 /* OSAllocator.h */,
 				1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */,
+				97941A3F130299DB004A3447 /* OSRandomSource.cpp */,
+				97941A40130299DB004A3447 /* OSRandomSource.h */,
 				9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */,
-				BCFBE697122561D200309E9D /* OwnArrayPtrCommon.h */,
 				0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */,
 				9303F567099118FA00AD71B8 /* OwnPtr.h */,
 				440B7AED0FAF7FCB0073323E /* OwnPtrCommon.h */,
@@ -1578,6 +1585,7 @@
 				6580F795094070560082C219 /* PassRefPtr.h */,
 				65D6D87E09B5A32E0002E4D7 /* Platform.h */,
 				A7D649A91015224E009B2E1B /* PossiblyNull.h */,
+				E4D8CE9B12FC42E100BC9F5A /* BloomFilter.h */,
 				088FA5B90EF76D4300578E6F /* RandomNumber.cpp */,
 				088FA5BA0EF76D4300578E6F /* RandomNumber.h */,
 				08E279E80EF83B10007DB523 /* RandomNumberSeed.h */,
@@ -1626,23 +1634,6 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
-		65417203039E01F90058BFEB /* pcre */ = {
-			isa = PBXGroup;
-			children = (
-				6541720F039E08B90058BFEB /* pcre.h */,
-				930754BF08B0F68000AB3056 /* pcre_compile.cpp */,
-				930754E908B0F78500AB3056 /* pcre_exec.cpp */,
-				93E26BE508B1517100F85226 /* pcre_internal.h */,
-				930754CE08B0F74500AB3056 /* pcre_tables.cpp */,
-				937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */,
-				93E26BD308B1514100F85226 /* pcre_xclass.cpp */,
-				93E26BFC08B151D400F85226 /* ucpinternal.h */,
-			);
-			path = pcre;
-			sourceTree = "<group>";
-			tabWidth = 4;
-			usesTabs = 0;
-		};
 		7E39D81D0EC38EFA003AF11A /* bytecompiler */ = {
 			isa = PBXGroup;
 			children = (
@@ -1675,6 +1666,9 @@
 				93052C330FB792190048FDC3 /* ParserArena.h */,
 				869EBCB60E8C6D4A008722CC /* ResultType.h */,
 				65E866EE0DD59AFA00A2B2A1 /* SourceCode.h */,
+				E49DC15512EF277200184A1F /* SourceProviderCache.cpp */,
+				E49DC15112EF272200184A1F /* SourceProviderCache.h */,
+				E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */,
 				65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */,
 				A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */,
 			);
@@ -1703,11 +1697,12 @@
 				BCA62DFE0E2826230004F30D /* CallData.cpp */,
 				145C507F0D9DF63B0088F6B9 /* CallData.h */,
 				BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */,
-				14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */,
 				65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */,
 				65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */,
 				969A09220ED1E09C00F1F681 /* Completion.cpp */,
 				F5BB2BC5030F772101FCFE1D /* Completion.h */,
+				146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */,
+				149DAAF212EB559D0083B12B /* ConservativeSet.h */,
 				BCA62DFF0E2826310004F30D /* ConstructData.cpp */,
 				BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */,
 				BCD203450E17135E002C7E82 /* DateConstructor.cpp */,
@@ -1804,6 +1799,8 @@
 				F692A8690255597D01FF60F7 /* Lookup.h */,
 				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
 				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
+				14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */,
+				14C824AC12F7C785008F35E0 /* MarkedBlock.h */,
 				140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */,
 				140CDC7712DBEA330013CFC5 /* MarkedSpace.h */,
 				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
@@ -1890,6 +1887,7 @@
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
 				14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
+				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -2053,6 +2051,7 @@
 			isa = PBXGroup;
 			children = (
 				E195678E09E7CF1200B89D13 /* icu */,
+				2CFC5B7A12F44714004914E2 /* CharacterNames.h */,
 				E1A862AA0D7EBB7D001EC6AA /* Collator.h */,
 				E1A862D50D7F2B5C001EC6AA /* CollatorDefault.cpp */,
 				E195679409E7CF1200B89D13 /* Unicode.h */,
@@ -2122,11 +2121,11 @@
 				BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */,
 				1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */,
 				95E3BC050E1AE68200B2D1C1 /* CallIdentifier.h in Headers */,
+				2CFC5D1E12F45B48004914E2 /* CharacterNames.h in Headers */,
 				BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */,
 				969A07970ED1D3AE00F1F681 /* CodeBlock.h in Headers */,
 				86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */,
 				BC18C3F00E16F5CD00B34460 /* Collator.h in Headers */,
-				14F3488F0E95EF8A003648BC /* CollectorHeapIterator.h in Headers */,
 				BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */,
 				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
 				FDA15C1E12B0305C003A583A /* Complex.h in Headers */,
@@ -2286,7 +2285,6 @@
 				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
 				1400067712A6F7830064D123 /* OSAllocator.h in Headers */,
 				BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */,
-				BCFBE698122561D200309E9D /* OwnArrayPtrCommon.h in Headers */,
 				0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */,
 				BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */,
 				4409D8470FAF80A200523B87 /* OwnPtrCommon.h in Headers */,
@@ -2300,8 +2298,6 @@
 				BCFBE696122560E800309E9D /* PassOwnArrayPtr.h in Headers */,
 				44DD48530FAEA85000D6B4EB /* PassOwnPtr.h in Headers */,
 				BC18C44C0E16F5CD00B34460 /* PassRefPtr.h in Headers */,
-				BC18C44D0E16F5CD00B34460 /* pcre.h in Headers */,
-				BC18C44E0E16F5CD00B34460 /* pcre_internal.h in Headers */,
 				BC18C44F0E16F5CD00B34460 /* Platform.h in Headers */,
 				A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */,
 				BC18C4500E16F5CD00B34460 /* Profile.h in Headers */,
@@ -2383,7 +2379,6 @@
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
 				5D53726F0E1C54880021E549 /* Tracing.h in Headers */,
 				0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */,
-				BC18C4720E16F5CD00B34460 /* ucpinternal.h in Headers */,
 				BC18C4730E16F5CD00B34460 /* Unicode.h in Headers */,
 				BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */,
 				BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */,
@@ -2413,6 +2408,13 @@
 				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
 				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
 				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
+				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
+				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
+				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
+				14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */,
+				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
+				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
+				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2569,7 +2571,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ -f ../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../Tools/Scripts/check-for-weak-vtables-and-externals || exit $?\nfi";
+			shellScript = "if [ -f ../../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../../Tools/Scripts/check-for-weak-vtables-and-externals || exit $?\nfi";
 		};
 		5D2F7CF90C6875BB00B5B72B /* Update Info.plist with version information */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -2645,7 +2647,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ -f ../Tools/Scripts/check-for-global-initializers ]; then\n    ../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
+			shellScript = "if [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
 		};
 		933457200EBFDC3F00B80894 /* Check For Exit Time Destructors */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -2660,7 +2662,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "if [ -f ../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
+			shellScript = "if [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
 		};
 /* End PBXShellScriptBuildPhase section */
 
@@ -2711,6 +2713,7 @@
 				E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */,
 				147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */,
 				147F39C2107EC37600427A48 /* Completion.cpp in Sources */,
+				146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */,
 				1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */,
 				86565742115BE3DA00291F40 /* CString.cpp in Sources */,
 				180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */,
@@ -2824,11 +2827,6 @@
 				9714AF5E122F32070092D9F5 /* ParsedURL.cpp in Sources */,
 				148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */,
 				93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */,
-				930754C108B0F68000AB3056 /* pcre_compile.cpp in Sources */,
-				930754EB08B0F78500AB3056 /* pcre_exec.cpp in Sources */,
-				930754D008B0F74600AB3056 /* pcre_tables.cpp in Sources */,
-				937013480CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp in Sources */,
-				93E26BD408B1514100F85226 /* pcre_xclass.cpp in Sources */,
 				95742F650DD11F5A000917FB /* Profile.cpp in Sources */,
 				95CD45760E1C4FDD0085358E /* ProfileGenerator.cpp in Sources */,
 				95AB83560DA43C3000BC83F3 /* ProfileNode.cpp in Sources */,
@@ -2858,6 +2856,7 @@
 				868BFA0E117CEFD100B908B1 /* StringImpl.cpp in Sources */,
 				14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
 				14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
+				9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
 				8626BECF11928E3900782FAB /* StringStatics.cpp in Sources */,
 				BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
 				7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
@@ -2878,7 +2877,10 @@
 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
-				9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
+				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
+				14C824AB12F7C77E008F35E0 /* MarkedBlock.cpp in Sources */,
+				97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */,
+				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index aa85c88..3fcfec8 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -661,21 +661,26 @@ public:
         set32Compare32(cond, left, right, dest);
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, RegisterID reg, Imm32 mask, RegisterID dest)
     {
-        load32(address, ARMRegisters::S1);
         if (mask.m_value == -1)
-            m_assembler.cmp_r(0, ARMRegisters::S1);
+            m_assembler.cmp_r(0, reg);
         else
-            m_assembler.tst_r(ARMRegisters::S1, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
+            m_assembler.tst_r(reg, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load32(address, ARMRegisters::S1);
+        set32Test32(cond, ARMRegisters::S1, mask, dest);
+    }
+
     void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
-        // ARM doesn't have byte registers
-        set32Test32(cond, address, mask, dest);
+        load8(address, ARMRegisters::S1);
+        set32Test32(cond, ARMRegisters::S1, mask, dest);
     }
 
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index f3f5f27..5fba8bb 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1361,6 +1361,7 @@ void CodeBlock::dumpStatistics()
 
 CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab, bool isConstructor)
     : m_globalObject(globalObject)
+    , m_heap(&m_globalObject->globalData().heap)
     , m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_numParameters(0)
@@ -1529,12 +1530,11 @@ void CodeBlock::refStructures(Instruction* vPC) const
 void CodeBlock::markAggregate(MarkStack& markStack)
 {
     for (size_t i = 0; i < m_constantRegisters.size(); ++i)
-        markStack.append(m_constantRegisters[i].jsValue());
+        markStack.deprecatedAppend(&m_constantRegisters[i]);
     for (size_t i = 0; i < m_functionExprs.size(); ++i)
         m_functionExprs[i]->markAggregate(markStack);
     for (size_t i = 0; i < m_functionDecls.size(); ++i)
         m_functionDecls[i]->markAggregate(markStack);
-    markStack.append(m_globalObject);
 }
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 1cd0863..f8498b4 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -248,7 +248,8 @@ namespace JSC {
     protected:
         CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable, bool isConstructor);
 
-        JSGlobalObject* m_globalObject;
+        DeprecatedPtr<JSGlobalObject> m_globalObject;
+        Heap* m_heap;
 
     public:
         virtual ~CodeBlock();
@@ -485,7 +486,7 @@ namespace JSC {
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
 
-        JSGlobalObject* globalObject() { return m_globalObject; }
+        JSGlobalObject* globalObject() { return m_globalObject.get(); }
 
         // Jump Tables
 
@@ -616,17 +617,14 @@ namespace JSC {
         GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
             : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, &m_unsharedSymbolTable, false)
         {
-            m_globalObject->codeBlocks().add(this);
+            m_heap->codeBlocks().add(this);
         }
 
         ~GlobalCodeBlock()
         {
-            if (m_globalObject)
-                m_globalObject->codeBlocks().remove(this);
+            m_heap->codeBlocks().remove(this);
         }
 
-        void clearGlobalObject() { m_globalObject = 0; }
-
     private:
         SymbolTable m_unsharedSymbolTable;
     };
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 78c373a..0964344 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -251,7 +251,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
     for (SymbolTable::iterator it = symbolTable->begin(); it != end; ++it)
         registerFor(it->second.getIndex()).setIndex(it->second.getIndex() + m_globalVarStorageOffset);
         
-    BatchedTransitionOptimizer optimizer(globalObject);
+    BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
 
     const VarStack& varStack = programNode->varStack();
     const FunctionStack& functionStack = programNode->functionStack();
@@ -903,7 +903,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond,
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject()->d()->callFunction);
+    instructions().append(m_scopeChain->globalObject()->d()->callFunction.get());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -914,7 +914,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
+    instructions().append(m_scopeChain->globalObject()->d()->applyFunction.get());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -1117,7 +1117,7 @@ bool BytecodeGenerator::findScopedProperty(const Identifier& property, int& inde
 
         if (shouldOptimizeLocals() && m_codeType == GlobalCode) {
             ScopeChainIterator iter = m_scopeChain->begin();
-            globalObject = *iter;
+            globalObject = iter->get();
             ASSERT((++iter) == m_scopeChain->end());
         }
         return false;
@@ -1128,7 +1128,7 @@ bool BytecodeGenerator::findScopedProperty(const Identifier& property, int& inde
     ScopeChainIterator iter = m_scopeChain->begin();
     ScopeChainIterator end = m_scopeChain->end();
     for (; iter != end; ++iter, ++depth) {
-        JSObject* currentScope = *iter;
+        JSObject* currentScope = iter->get();
         if (!currentScope->isVariableObject())
             break;
         JSVariableObject* currentVariableObject = static_cast<JSVariableObject*>(currentScope);
@@ -1157,7 +1157,7 @@ bool BytecodeGenerator::findScopedProperty(const Identifier& property, int& inde
     // Can't locate the property but we're able to avoid a few lookups.
     stackDepth = depth + m_codeBlock->needsFullScopeChain();
     index = missingSymbolMarker();
-    JSObject* scope = *iter;
+    JSObject* scope = iter->get();
     if (++iter == end)
         globalObject = scope;
     return true;
diff --git a/Source/JavaScriptCore/config.h b/Source/JavaScriptCore/config.h
index a2b6285..1c14917 100644
--- a/Source/JavaScriptCore/config.h
+++ b/Source/JavaScriptCore/config.h
@@ -57,6 +57,10 @@
 
 #endif
 
+#if OS(UNIX) || OS(WINDOWS)
+#define WTF_USE_OS_RANDOMNESS 1
+#endif
+
 #if OS(FREEBSD) || OS(OPENBSD)
 #define HAVE_PTHREAD_NP_H 1
 #endif
diff --git a/Source/JavaScriptCore/create_regex_tables b/Source/JavaScriptCore/create_regex_tables
index d1cc1c2..c6ce995 100644
--- a/Source/JavaScriptCore/create_regex_tables
+++ b/Source/JavaScriptCore/create_regex_tables
@@ -21,6 +21,8 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
+import sys
+
 types = {
     "wordchar": { "UseTable" : True, "data": ['_', ('0','9'), ('A', 'Z'), ('a','z')]},
     "nonwordchar": { "UseTable" : True, "Inverse": "wordchar", "data": ['`', (0, ord('0') - 1), (ord('9') + 1, ord('A') - 1), (ord('Z') + 1, ord('_') - 1), (ord('z') + 1, 0xffff)]},
@@ -107,6 +109,12 @@ for name, classes in types.items():
     function += ("}\n\n")
     functions += function
 
-print(arrays)
-print(functions)
+if (len(sys.argv) > 1):
+    f = open(sys.argv[-1], "w")
+    f.write(arrays)
+    f.write(functions)
+    f.close()
+else:
+    print(arrays)
+    print(functions)
 
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index 23b9361..20a8485 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "Debugger.h"
 
-#include "CollectorHeapIterator.h"
 #include "Error.h"
 #include "Interpreter.h"
 #include "JSFunction.h"
@@ -32,6 +31,57 @@
 
 namespace JSC {
 
+class Recompiler {
+public:
+    Recompiler(Debugger*);
+    ~Recompiler();
+    void operator()(JSCell*);
+
+private:
+    typedef HashSet<FunctionExecutable*> FunctionExecutableSet;
+    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
+    
+    Debugger* m_debugger;
+    FunctionExecutableSet m_functionExecutables;
+    SourceProviderMap m_sourceProviders;
+};
+
+inline Recompiler::Recompiler(Debugger* debugger)
+    : m_debugger(debugger)
+{
+}
+
+inline Recompiler::~Recompiler()
+{
+    // Call sourceParsed() after reparsing all functions because it will execute
+    // JavaScript in the inspector.
+    SourceProviderMap::const_iterator end = m_sourceProviders.end();
+    for (SourceProviderMap::const_iterator iter = m_sourceProviders.begin(); iter != end; ++iter)
+        m_debugger->sourceParsed(iter->second, iter->first, -1, UString());
+}
+
+inline void Recompiler::operator()(JSCell* cell)
+{
+    if (!cell->inherits(&JSFunction::info))
+        return;
+
+    JSFunction* function = asFunction(cell);
+    if (function->executable()->isHostFunction())
+        return;
+
+    FunctionExecutable* executable = function->jsExecutable();
+
+    // Check if the function is already in the set - if so,
+    // we've already retranslated it, nothing to do here.
+    if (!m_functionExecutables.add(executable).second)
+        return;
+
+    ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
+    executable->discardCode();
+    if (m_debugger == function->scope().globalObject()->debugger())
+        m_sourceProviders.add(executable->source().provider(), exec);
+}
+
 Debugger::~Debugger()
 {
     HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
@@ -61,40 +111,8 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     if (globalData->dynamicGlobalObject)
         return;
 
-    typedef HashSet<FunctionExecutable*> FunctionExecutableSet;
-    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
-
-    FunctionExecutableSet functionExecutables;
-    SourceProviderMap sourceProviders;
-
-    LiveObjectIterator it = globalData->heap.primaryHeapBegin();
-    LiveObjectIterator heapEnd = globalData->heap.primaryHeapEnd();
-    for ( ; it != heapEnd; ++it) {
-        if (!(*it)->inherits(&JSFunction::info))
-            continue;
-
-        JSFunction* function = asFunction(*it);
-        if (function->executable()->isHostFunction())
-            continue;
-
-        FunctionExecutable* executable = function->jsExecutable();
-
-        // Check if the function is already in the set - if so,
-        // we've already retranslated it, nothing to do here.
-        if (!functionExecutables.add(executable).second)
-            continue;
-
-        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
-        executable->discardCode();
-        if (function->scope().globalObject()->debugger() == this)
-            sourceProviders.add(executable->source().provider(), exec);
-    }
-
-    // Call sourceParsed() after reparsing all functions because it will execute
-    // JavaScript in the inspector.
-    SourceProviderMap::const_iterator end = sourceProviders.end();
-    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed(iter->second, iter->first, -1, UString());
+    Recompiler recompiler(this);
+    globalData->heap.forEach(recompiler);
 }
 
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
@@ -109,7 +127,7 @@ JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSG
     JSGlobalData& globalData = globalObject->globalData();
     JSValue result = globalData.interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception;
+        exception = globalData.exception.get();
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
index 0444d23..fcd257c 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -30,12 +30,12 @@
 
 namespace JSC {
 
-DebuggerActivation::DebuggerActivation(JSObject* activation)
+DebuggerActivation::DebuggerActivation(JSGlobalData& globalData, JSObject* activation)
     : JSObject(DebuggerActivation::createStructure(jsNull()))
 {
     ASSERT(activation);
     ASSERT(activation->isActivationObject());
-    m_activation = static_cast<JSActivation*>(activation);
+    m_activation.set(globalData, this, static_cast<JSActivation*>(activation));
 }
 
 void DebuggerActivation::markChildren(MarkStack& markStack)
@@ -43,7 +43,7 @@ void DebuggerActivation::markChildren(MarkStack& markStack)
     JSObject::markChildren(markStack);
 
     if (m_activation)
-        markStack.append(m_activation);
+        markStack.append(&m_activation);
 }
 
 UString DebuggerActivation::className() const
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.h b/Source/JavaScriptCore/debugger/DebuggerActivation.h
index 3927017..b64060d 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.h
@@ -34,7 +34,7 @@ namespace JSC {
 
     class DebuggerActivation : public JSObject {
     public:
-        DebuggerActivation(JSObject*);
+        DebuggerActivation(JSGlobalData&, JSObject*);
 
         virtual void markChildren(MarkStack&);
         virtual UString className() const;
@@ -58,7 +58,7 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | JSObject::StructureFlags;
 
     private:
-        JSActivation* m_activation;
+        WriteBarrier<JSActivation> m_activation;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index ed673cb..cb4592c 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -96,7 +96,7 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     JSGlobalData& globalData = m_callFrame->globalData();
     JSValue result = globalData.interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception;
+        exception = globalData.exception.get();
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index 2797ef3..190a7c1 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -75,7 +75,7 @@ namespace JSC  {
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
         void clearException() { globalData().exception = JSValue(); }
-        JSValue exception() const { return globalData().exception; }
+        JSValue exception() const { return globalData().exception.get(); }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index 392e8b8..c2612ac 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -103,11 +103,11 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
     CodeBlock* codeBlock = callFrame->codeBlock();
     Identifier& ident = codeBlock->identifier(property);
     do {
-        JSObject* o = *iter;
+        JSObject* o = iter->get();
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
+            exceptionValue = callFrame->globalData().exception.get();
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(dst) = JSValue(result);
@@ -142,11 +142,11 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
     }
     Identifier& ident = codeBlock->identifier(property);
     do {
-        JSObject* o = *iter;
+        JSObject* o = iter->get();
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
+            exceptionValue = callFrame->globalData().exception.get();
             if (exceptionValue)
                 return false;
             ASSERT(result);
@@ -187,7 +187,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
             return true;
         }
 
-        exceptionValue = callFrame->globalData().exception;
+        exceptionValue = callFrame->globalData().exception.get();
         if (exceptionValue)
             return false;
         callFrame->uncheckedR(dst) = JSValue(result);
@@ -220,14 +220,14 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
             ++iter;
     }
     while (skip--) {
-        JSObject* o = *iter;
+        JSObject* o = iter->get();
         if (o->hasCustomProperties()) {
             Identifier& ident = codeBlock->identifier(property);
             do {
                 PropertySlot slot(o);
                 if (o->getPropertySlot(callFrame, ident, slot)) {
                     JSValue result = slot.getValue(callFrame, ident);
-                    exceptionValue = callFrame->globalData().exception;
+                    exceptionValue = callFrame->globalData().exception.get();
                     if (exceptionValue)
                         return false;
                     ASSERT(result);
@@ -236,7 +236,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
                 }
                 if (iter == end)
                     break;
-                o = *iter;
+                o = iter->get();
                 ++iter;
             } while (true);
             exceptionValue = createUndefinedVariableError(callFrame, ident);
@@ -266,7 +266,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
             return true;
         }
         
-        exceptionValue = callFrame->globalData().exception;
+        exceptionValue = callFrame->globalData().exception.get();
         if (exceptionValue)
             return false;
         ASSERT(result);
@@ -310,11 +310,11 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     Identifier& ident = codeBlock->identifier(property);
     JSObject* base;
     do {
-        base = *iter;
+        base = iter->get();
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
+            exceptionValue = callFrame->globalData().exception.get();
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(propDst) = JSValue(result);
@@ -566,11 +566,13 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
         }
         while (!scopeChain->object->inherits(&JSActivation::info))
             scopeChain = scopeChain->pop();
-        JSActivation* activation = asActivation(scopeChain->object);
+
+        callFrame->setScopeChain(scopeChain);
+        JSActivation* activation = asActivation(scopeChain->object.get());
         activation->copyRegisters();
         if (JSValue arguments = callFrame->uncheckedR(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue()) {
             if (!oldCodeBlock->isStrictMode())
-                asArguments(arguments)->setActivation(activation);
+                asArguments(arguments)->setActivation(callFrame->globalData(), activation);
         }
     } else if (oldCodeBlock->usesArguments() && !oldCodeBlock->isStrictMode()) {
         if (JSValue arguments = callFrame->uncheckedR(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue())
@@ -648,7 +650,7 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
         message = makeUString(message, " (near '...", codeBlock->source()->getRange(start, stop), "...')");
     }
 
-    exception->putDirect(globalData->propertyNames->message, jsString(globalData, message));
+    exception->putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
 NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset)
@@ -1085,7 +1087,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     for (ScopeChainNode* node = scopeChain; ; node = node->next) {
         ASSERT(node);
         if (node->object->isVariableObject()) {
-            variableObject = static_cast<JSVariableObject*>(node->object);
+            variableObject = static_cast<JSVariableObject*>(node->object.get());
             break;
         }
     }
@@ -1100,7 +1102,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
             pushedScope = true;
         }
         // Scope for BatchedTransitionOptimizer
-        BatchedTransitionOptimizer optimizer(variableObject);
+        BatchedTransitionOptimizer optimizer(callFrame->globalData(), variableObject);
 
         for (unsigned i = 0; i < numVariables; ++i) {
             const Identifier& ident = codeBlock->variable(i);
@@ -1371,7 +1373,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (baseObject->structure()->isDictionary()) {
-            baseObject->flattenDictionaryObject();
+            baseObject->flattenDictionaryObject(callFrame->globalData());
             offset = baseObject->structure()->get(propertyName);
         }
 
@@ -1475,8 +1477,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception != JSValue())) { \
-            exceptionValue = globalData->exception; \
+        if (UNLIKELY(globalData->exception.get() != JSValue())) { \
+            exceptionValue = globalData->exception.get(); \
             goto vm_throw; \
         } \
     } while (0)
@@ -2408,7 +2410,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ASSERT(iter != end);
         }
         ASSERT((*iter)->isVariableObject());
-        JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
+        JSVariableObject* scope = static_cast<JSVariableObject*>(iter->get());
         callFrame->uncheckedR(dst) = scope->registerAt(index);
         ASSERT(callFrame->r(dst).jsValue());
         vPC += OPCODE_LENGTH(op_get_scoped_var);
@@ -2439,7 +2441,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
 
         ASSERT((*iter)->isVariableObject());
-        JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
+        JSVariableObject* scope = static_cast<JSVariableObject*>(iter->get());
         ASSERT(callFrame->r(value).jsValue());
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
         vPC += OPCODE_LENGTH(op_put_scoped_var);
@@ -3080,7 +3082,7 @@ skip_id_custom_self:
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
+                baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_transition);
                 NEXT_INSTRUCTION();
@@ -3115,7 +3117,7 @@ skip_id_custom_self:
                 unsigned offset = vPC[5].u.operand;
                 
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
+                baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_replace);
                 NEXT_INSTRUCTION();
@@ -3309,7 +3311,7 @@ skip_id_custom_self:
             if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canSetIndex(i))
-                    jsArray->setIndex(i, callFrame->r(value).jsValue());
+                    jsArray->setIndex(*globalData, i, callFrame->r(value).jsValue());
                 else
                     jsArray->JSArray::put(callFrame, i, callFrame->r(value).jsValue());
             } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
@@ -3835,7 +3837,7 @@ skip_id_custom_self:
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
             JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset);
-            if ((exceptionValue = globalData->exception))
+            if ((exceptionValue = globalData->exception.get()))
                 goto vm_throw;
             functionReturnValue = result;
 
@@ -4103,7 +4105,7 @@ skip_id_custom_self:
 
             if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
                 if (!codeBlock->isStrictMode())
-                    asArguments(argumentsValue)->setActivation(asActivation(activationValue));
+                    asArguments(argumentsValue)->setActivation(*globalData, asActivation(activationValue));
             }
         } else if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
             if (!codeBlock->isStrictMode())
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index 9dfc432..e9c6df1 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -132,8 +132,6 @@ namespace JSC {
 
         Register* lastGlobal() const { return m_start - m_numGlobals; }
         
-        void markCallFrames(ConservativeSet& conservativeSet, Heap* heap) { heap->markConservatively(conservativeSet, m_start, m_end); }
-
         static size_t committedByteCount();
         static void initializeThreading();
 
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
index fa6db83..35531d9 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
@@ -85,7 +85,7 @@ size_t ExecutableAllocator::committedByteCount()
 #error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
 #endif
 
-void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
+void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSetting setting)
 {
     if (!pageSize)
         intializePageSize();
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.h b/Source/JavaScriptCore/jit/ExecutableAllocator.h
index 3233412..57ee054 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.h
@@ -167,7 +167,7 @@ private:
 };
 
 class ExecutableAllocator {
-    enum ProtectionSeting { Writable, Executable };
+    enum ProtectionSetting { Writable, Executable };
 
 public:
     static size_t pageSize;
@@ -318,7 +318,7 @@ public:
 private:
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
-    static void reprotectRegion(void*, size_t, ProtectionSeting);
+    static void reprotectRegion(void*, size_t, ProtectionSetting);
 #endif
 
     RefPtr<ExecutablePool> m_smallAllocationPool;
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 9fc889e..6a945b0 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -42,407 +42,453 @@
 #include <stdio.h>
 #endif
 
-static const unsigned vmPoolSizeOvercommit = 2u * 1024u * 1024u * 1024u; // 2Gb
-static const unsigned coalesceLimitOvercommit = 16u * 1024u * 1024u; // 16Mb
-
-static const unsigned vmPoolSizeNoOvercommit = 32u * 1024u * 1024u; // 32Mb
-static const unsigned coalesceLimitNoOvercommit = 4u * 1024u * 1024u; // 4Mb
-
-static const unsigned vmPoolSizeEmbedded = 16u * 1024u * 1024u; // 16Mb
-static const unsigned coalesceLimitEmbedded = 4u * 1024u * 1024u; // 4Mb
-
-#if CPU(X86_64) && !OS(LINUX)
-// These limits suitable on 64-bit platforms (particularly x86-64,
-// where we require all jumps to have a 2Gb max range). We don't
-// enable this by default on Linux, since it needs overcommit and
-// distros commonly disable that feature. We'll check the value
-// for the overcommit feature at runtime and re-assign the Generic
-// values if it's enabled.
-static unsigned vmPoolSize = vmPoolSizeOvercommit;
-static unsigned coalesceLimit = coalesceLimitOvercommit;
-#elif CPU(ARM)
-static unsigned vmPoolSize = vmPoolSizeEmbedded;
-static unsigned coalesceLimit = coalesceLimitEmbedded;
-#else
-static unsigned vmPoolSize = vmPoolSizeNoOvercommit;
-static unsigned coalesceLimit = coalesceLimitNoOvercommit;
-#endif
-
 using namespace WTF;
 
 namespace JSC {
     
-static size_t committedBytesCount = 0;  
-static SpinLock spinlock = SPINLOCK_INITIALIZER;
+#define TwoPow(n) (1ull << n)
+
+class AllocationTableSizeClass {
+public:
+    AllocationTableSizeClass(size_t size, size_t blockSize, unsigned log2BlockSize)
+        : m_blockSize(blockSize)
+    {
+        ASSERT(blockSize == TwoPow(log2BlockSize));
+
+        // Calculate the number of blocks needed to hold size.
+        size_t blockMask = blockSize - 1;
+        m_blockCount = (size + blockMask) >> log2BlockSize;
+
+        // Align to the smallest power of two >= m_blockCount.
+        m_blockAlignment = 1;
+        while (m_blockAlignment < m_blockCount)
+            m_blockAlignment += m_blockAlignment;
+    }
+
+    size_t blockSize() const { return m_blockSize; }
+    size_t blockCount() const { return m_blockCount; }
+    size_t blockAlignment() const { return m_blockAlignment; }
 
-// FreeListEntry describes a free chunk of memory, stored in the freeList.
-struct FreeListEntry {
-    FreeListEntry(void* pointer, size_t size)
-        : pointer(pointer)
-        , size(size)
-        , nextEntry(0)
-        , less(0)
-        , greater(0)
-        , balanceFactor(0)
-    {
-    }
-
-    // All entries of the same size share a single entry
-    // in the AVLTree, and are linked together in a linked
-    // list, using nextEntry.
-    void* pointer;
-    size_t size;
-    FreeListEntry* nextEntry;
-
-    // These fields are used by AVLTree.
-    FreeListEntry* less;
-    FreeListEntry* greater;
-    int balanceFactor;
+    size_t size()
+    {
+        return m_blockSize * m_blockCount;
+    }
+
+private:
+    size_t m_blockSize;
+    size_t m_blockCount;
+    size_t m_blockAlignment;
 };
 
-// Abstractor class for use in AVLTree.
-// Nodes in the AVLTree are of type FreeListEntry, keyed on
-// (and thus sorted by) their size.
-struct AVLTreeAbstractorForFreeList {
-    typedef FreeListEntry* handle;
-    typedef int32_t size;
-    typedef size_t key;
-
-    handle get_less(handle h) { return h->less; }
-    void set_less(handle h, handle lh) { h->less = lh; }
-    handle get_greater(handle h) { return h->greater; }
-    void set_greater(handle h, handle gh) { h->greater = gh; }
-    int get_balance_factor(handle h) { return h->balanceFactor; }
-    void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
-
-    static handle null() { return 0; }
-
-    int compare_key_key(key va, key vb) { return va - vb; }
-    int compare_key_node(key k, handle h) { return compare_key_key(k, h->size); }
-    int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->size, h2->size); }
+template<unsigned log2Entries>
+class AllocationTableLeaf {
+    typedef uint64_t BitField;
+
+public:
+    static const unsigned log2SubregionSize = 12; // 2^12 == pagesize
+    static const unsigned log2RegionSize = log2SubregionSize + log2Entries;
+
+    static const size_t subregionSize = TwoPow(log2SubregionSize);
+    static const size_t regionSize = TwoPow(log2RegionSize);
+    static const unsigned entries = TwoPow(log2Entries);
+    COMPILE_ASSERT(entries <= (sizeof(BitField) * 8), AllocationTableLeaf_entries_fit_in_BitField);
+
+    AllocationTableLeaf()
+        : m_allocated(0)
+    {
+    }
+
+    ~AllocationTableLeaf()
+    {
+        ASSERT(isEmpty());
+    }
+
+    size_t allocate(AllocationTableSizeClass& sizeClass)
+    {
+        ASSERT(sizeClass.blockSize() == subregionSize);
+        ASSERT(!isFull());
+
+        size_t alignment = sizeClass.blockAlignment();
+        size_t count = sizeClass.blockCount();
+        // Use this mask to check for spans of free blocks.
+        BitField mask = ((1ull << count) - 1) << (alignment - count);
+
+        // Step in units of alignment size.
+        for (unsigned i = 0; i < entries; i += alignment) {
+            if (!(m_allocated & mask)) {
+                m_allocated |= mask;
+                return (i + (alignment - count)) << log2SubregionSize;
+            }
+            mask <<= alignment;
+        }
+        return notFound;
+    }
+
+    void free(size_t location, AllocationTableSizeClass& sizeClass)
+    {
+        ASSERT(sizeClass.blockSize() == subregionSize);
+
+        size_t entry = location >> log2SubregionSize;
+        size_t count = sizeClass.blockCount();
+        BitField mask = ((1ull << count) - 1) << entry;
+
+        ASSERT((m_allocated & mask) == mask);
+        m_allocated &= ~mask;
+    }
+
+    bool isEmpty()
+    {
+        return !m_allocated;
+    }
+
+    bool isFull()
+    {
+        return !~m_allocated;
+    }
+
+    static size_t size()
+    {
+        return regionSize;
+    }
+
+    static AllocationTableSizeClass classForSize(size_t size)
+    {
+        return AllocationTableSizeClass(size, subregionSize, log2SubregionSize);
+    }
+
+#ifndef NDEBUG
+    void dump(size_t parentOffset = 0, unsigned indent = 0)
+    {
+        for (unsigned i = 0; i < indent; ++i)
+            fprintf(stderr, "    ");
+        fprintf(stderr, "%08x: [%016llx]\n", (int)parentOffset, m_allocated);
+    }
+#endif
+
+private:
+    BitField m_allocated;
 };
 
-// Used to reverse sort an array of FreeListEntry pointers.
-static int reverseSortFreeListEntriesByPointer(const void* leftPtr, const void* rightPtr)
-{
-    FreeListEntry* left = *(FreeListEntry**)leftPtr;
-    FreeListEntry* right = *(FreeListEntry**)rightPtr;
 
-    return (intptr_t)(right->pointer) - (intptr_t)(left->pointer);
-}
+template<class NextLevel>
+class LazyAllocationTable {
+public:
+    static const unsigned log2RegionSize = NextLevel::log2RegionSize;
+    static const unsigned entries = NextLevel::entries;
 
-// Used to reverse sort an array of pointers.
-static int reverseSortCommonSizedAllocations(const void* leftPtr, const void* rightPtr)
-{
-    void* left = *(void**)leftPtr;
-    void* right = *(void**)rightPtr;
+    LazyAllocationTable()
+        : m_ptr(0)
+    {
+    }
 
-    return (intptr_t)right - (intptr_t)left;
-}
+    ~LazyAllocationTable()
+    {
+        ASSERT(isEmpty());
+    }
 
-class FixedVMPoolAllocator
-{
-    // The free list is stored in a sorted tree.
-    typedef AVLTree<AVLTreeAbstractorForFreeList, 40> SizeSortedFreeTree;
-
-    void release(void* position, size_t size)
-    {
-        m_allocation.decommit(position, size);
-        addToCommittedByteCount(-static_cast<long>(size));
-    }
-
-    void reuse(void* position, size_t size)
-    {
-        m_allocation.commit(position, size);
-        addToCommittedByteCount(static_cast<long>(size));
-    }
-
-    // All addition to the free list should go through this method, rather than
-    // calling insert directly, to avoid multiple entries being added with the
-    // same key.  All nodes being added should be singletons, they should not
-    // already be a part of a chain.
-    void addToFreeList(FreeListEntry* entry)
-    {
-        ASSERT(!entry->nextEntry);
-
-        if (entry->size == m_commonSize) {
-            m_commonSizedAllocations.append(entry->pointer);
-            delete entry;
-        } else if (FreeListEntry* entryInFreeList = m_freeList.search(entry->size, m_freeList.EQUAL)) {
-            // m_freeList already contain an entry for this size - insert this node into the chain.
-            entry->nextEntry = entryInFreeList->nextEntry;
-            entryInFreeList->nextEntry = entry;
-        } else
-            m_freeList.insert(entry);
-    }
-
-    // We do not attempt to coalesce addition, which may lead to fragmentation;
-    // instead we periodically perform a sweep to try to coalesce neighboring
-    // entries in m_freeList.  Presently this is triggered at the point 16MB
-    // of memory has been released.
-    void coalesceFreeSpace()
-    {
-        Vector<FreeListEntry*> freeListEntries;
-        SizeSortedFreeTree::Iterator iter;
-        iter.start_iter_least(m_freeList);
-
-        // Empty m_freeList into a Vector.
-        for (FreeListEntry* entry; (entry = *iter); ++iter) {
-            // Each entry in m_freeList might correspond to multiple
-            // free chunks of memory (of the same size).  Walk the chain
-            // (this is likely of course only be one entry long!) adding
-            // each entry to the Vector (at reseting the next in chain
-            // pointer to separate each node out).
-            FreeListEntry* next;
-            do {
-                next = entry->nextEntry;
-                entry->nextEntry = 0;
-                freeListEntries.append(entry);
-            } while ((entry = next));
+    size_t allocate(AllocationTableSizeClass& sizeClass)
+    {
+        if (!m_ptr)
+            m_ptr = new NextLevel();
+        return m_ptr->allocate(sizeClass);
+    }
+
+    void free(size_t location, AllocationTableSizeClass& sizeClass)
+    {
+        ASSERT(m_ptr);
+        m_ptr->free(location, sizeClass);
+        if (m_ptr->isEmpty()) {
+            delete m_ptr;
+            m_ptr = 0;
         }
-        // All entries are now in the Vector; purge the tree.
-        m_freeList.purge();
-
-        // Reverse-sort the freeListEntries and m_commonSizedAllocations Vectors.
-        // We reverse-sort so that we can logically work forwards through memory,
-        // whilst popping items off the end of the Vectors using last() and removeLast().
-        qsort(freeListEntries.begin(), freeListEntries.size(), sizeof(FreeListEntry*), reverseSortFreeListEntriesByPointer);
-        qsort(m_commonSizedAllocations.begin(), m_commonSizedAllocations.size(), sizeof(void*), reverseSortCommonSizedAllocations);
-
-        // The entries from m_commonSizedAllocations that cannot be
-        // coalesced into larger chunks will be temporarily stored here.
-        Vector<void*> newCommonSizedAllocations;
-
-        // Keep processing so long as entries remain in either of the vectors.
-        while (freeListEntries.size() || m_commonSizedAllocations.size()) {
-            // We're going to try to find a FreeListEntry node that we can coalesce onto.
-            FreeListEntry* coalescionEntry = 0;
-
-            // Is the lowest addressed chunk of free memory of common-size, or is it in the free list?
-            if (m_commonSizedAllocations.size() && (!freeListEntries.size() || (m_commonSizedAllocations.last() < freeListEntries.last()->pointer))) {
-                // Pop an item from the m_commonSizedAllocations vector - this is the lowest
-                // addressed free chunk.  Find out the begin and end addresses of the memory chunk.
-                void* begin = m_commonSizedAllocations.last();
-                void* end = (void*)((intptr_t)begin + m_commonSize);
-                m_commonSizedAllocations.removeLast();
-
-                // Try to find another free chunk abutting onto the end of the one we have already found.
-                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
-                    // There is an existing FreeListEntry for the next chunk of memory!
-                    // we can reuse this.  Pop it off the end of m_freeList.
-                    coalescionEntry = freeListEntries.last();
-                    freeListEntries.removeLast();
-                    // Update the existing node to include the common-sized chunk that we also found. 
-                    coalescionEntry->pointer = (void*)((intptr_t)coalescionEntry->pointer - m_commonSize);
-                    coalescionEntry->size += m_commonSize;
-                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
-                    // There is a second common-sized chunk that can be coalesced.
-                    // Allocate a new node.
-                    m_commonSizedAllocations.removeLast();
-                    coalescionEntry = new FreeListEntry(begin, 2 * m_commonSize);
-                } else {
-                    // Nope - this poor little guy is all on his own. :-(
-                    // Add him into the newCommonSizedAllocations vector for now, we're
-                    // going to end up adding him back into the m_commonSizedAllocations
-                    // list when we're done.
-                    newCommonSizedAllocations.append(begin);
+    }
+
+    bool isEmpty()
+    {
+        return !m_ptr;
+    }
+
+    bool isFull()
+    {
+        return m_ptr && m_ptr->isFull();
+    }
+
+    static size_t size()
+    {
+        return NextLevel::size();
+    }
+
+#ifndef NDEBUG
+    void dump(size_t parentOffset = 0, unsigned indent = 0)
+    {
+        ASSERT(m_ptr);
+        m_ptr->dump(parentOffset, indent);
+    }
+#endif
+
+    static AllocationTableSizeClass classForSize(size_t size)
+    {
+        return NextLevel::classForSize(size);
+    }
+
+private:
+    NextLevel* m_ptr;
+};
+
+template<class NextLevel, unsigned log2Entries>
+class AllocationTableDirectory {
+    typedef uint64_t BitField;
+
+public:
+    static const unsigned log2SubregionSize = NextLevel::log2RegionSize;
+    static const unsigned log2RegionSize = log2SubregionSize + log2Entries;
+
+    static const size_t subregionSize = TwoPow(log2SubregionSize);
+    static const size_t regionSize = TwoPow(log2RegionSize);
+    static const unsigned entries = TwoPow(log2Entries);
+    COMPILE_ASSERT(entries <= (sizeof(BitField) * 8), AllocationTableDirectory_entries_fit_in_BitField);
+
+    AllocationTableDirectory()
+        : m_full(0)
+        , m_hasSuballocation(0)
+    {
+    }
+
+    ~AllocationTableDirectory()
+    {
+        ASSERT(isEmpty());
+    }
+
+    size_t allocate(AllocationTableSizeClass& sizeClass)
+    {
+        ASSERT(sizeClass.blockSize() <= subregionSize);
+        ASSERT(!isFull());
+
+        if (sizeClass.blockSize() < subregionSize) {
+            BitField bit = 1;
+            for (unsigned i = 0; i < entries; ++i, bit += bit) {
+                if (m_full & bit)
                     continue;
+                size_t location = m_suballocations[i].allocate(sizeClass);
+                if (location != notFound) {
+                    // If this didn't already have a subregion, it does now!
+                    m_hasSuballocation |= bit;
+                    // Mirror the suballocation's full bit.
+                    if (m_suballocations[i].isFull())
+                        m_full |= bit;
+                    return (i * subregionSize) | location;
                 }
-            } else {
-                ASSERT(freeListEntries.size());
-                ASSERT(!m_commonSizedAllocations.size() || (freeListEntries.last()->pointer < m_commonSizedAllocations.last()));
-                // The lowest addressed item is from m_freeList; pop it from the Vector.
-                coalescionEntry = freeListEntries.last();
-                freeListEntries.removeLast();
             }
-            
-            // Right, we have a FreeListEntry, we just need check if there is anything else
-            // to coalesce onto the end.
-            ASSERT(coalescionEntry);
-            while (true) {
-                // Calculate the end address of the chunk we have found so far.
-                void* end = (void*)((intptr_t)coalescionEntry->pointer - coalescionEntry->size);
-
-                // Is there another chunk adjacent to the one we already have?
-                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
-                    // Yes - another FreeListEntry -pop it from the list.
-                    FreeListEntry* coalescee = freeListEntries.last();
-                    freeListEntries.removeLast();
-                    // Add it's size onto our existing node.
-                    coalescionEntry->size += coalescee->size;
-                    delete coalescee;
-                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
-                    // We can coalesce the next common-sized chunk.
-                    m_commonSizedAllocations.removeLast();
-                    coalescionEntry->size += m_commonSize;
-                } else
-                    break; // Nope, nothing to be added - stop here.
+            return notFound;
+        }
+
+        // A block is allocated if either it is fully allocated or contains suballocations.
+        BitField allocated = m_full | m_hasSuballocation;
+
+        size_t alignment = sizeClass.blockAlignment();
+        size_t count = sizeClass.blockCount();
+        // Use this mask to check for spans of free blocks.
+        BitField mask = ((1ull << count) - 1) << (alignment - count);
+
+        // Step in units of alignment size.
+        for (unsigned i = 0; i < entries; i += alignment) {
+            if (!(allocated & mask)) {
+                m_full |= mask;
+                return (i + (alignment - count)) << log2SubregionSize;
             }
+            mask <<= alignment;
+        }
+        return notFound;
+    }
 
-            // We've coalesced everything we can onto the current chunk.
-            // Add it back into m_freeList.
-            addToFreeList(coalescionEntry);
+    void free(size_t location, AllocationTableSizeClass& sizeClass)
+    {
+        ASSERT(sizeClass.blockSize() <= subregionSize);
+
+        size_t entry = location >> log2SubregionSize;
+
+        if (sizeClass.blockSize() < subregionSize) {
+            BitField bit = 1ull << entry;
+            m_suballocations[entry].free(location & (subregionSize - 1), sizeClass);
+            // Check if the suballocation is now empty.
+            if (m_suballocations[entry].isEmpty())
+                m_hasSuballocation &= ~bit;
+            // No need to check, it clearly isn't full any more!
+            m_full &= ~bit;
+        } else {
+            size_t count = sizeClass.blockCount();
+            BitField mask = ((1ull << count) - 1) << entry;
+            ASSERT((m_full & mask) == mask);
+            ASSERT(!(m_hasSuballocation & mask));
+            m_full &= ~mask;
         }
+    }
 
-        // All chunks of free memory larger than m_commonSize should be
-        // back in m_freeList by now.  All that remains to be done is to
-        // copy the contents on the newCommonSizedAllocations back into
-        // the m_commonSizedAllocations Vector.
-        ASSERT(m_commonSizedAllocations.size() == 0);
-        m_commonSizedAllocations.append(newCommonSizedAllocations);
+    bool isEmpty()
+    {
+        return !(m_full | m_hasSuballocation);
     }
 
-public:
+    bool isFull()
+    {   
+        return !~m_full;
+    }
+
+    static size_t size()
+    {
+        return regionSize;
+    }
+
+    static AllocationTableSizeClass classForSize(size_t size)
+    {
+        if (size < subregionSize) {
+            AllocationTableSizeClass sizeClass = NextLevel::classForSize(size);
+            if (sizeClass.size() < NextLevel::size())
+                return sizeClass;
+        }
+        return AllocationTableSizeClass(size, subregionSize, log2SubregionSize);
+    }
+
+#ifndef NDEBUG
+    void dump(size_t parentOffset = 0, unsigned indent = 0)
+    {
+        for (unsigned i = 0; i < indent; ++i)
+            fprintf(stderr, "    ");
+        fprintf(stderr, "%08x: [", (int)parentOffset);
+        for (unsigned i = 0; i < entries; ++i) {
+            BitField bit = 1ull << i;
+            char c = m_hasSuballocation & bit
+                ? (m_full & bit ? 'N' : 'n')
+                : (m_full & bit ? 'F' : '-');
+            fprintf(stderr, "%c", c);
+        }
+        fprintf(stderr, "]\n");
+
+        for (unsigned i = 0; i < entries; ++i) {
+            BitField bit = 1ull << i;
+            size_t offset = parentOffset | (subregionSize * i);
+            if (m_hasSuballocation & bit)
+                m_suballocations[i].dump(offset, indent + 1);
+        }
+    }
+#endif
+
+private:
+    NextLevel m_suballocations[entries];
+    // Subregions exist in one of four states:
+    // (1) empty (both bits clear)
+    // (2) fully allocated as a single allocation (m_full set)
+    // (3) partially allocated through suballocations (m_hasSuballocation set)
+    // (4) fully allocated through suballocations (both bits set)
+    BitField m_full;
+    BitField m_hasSuballocation;
+};
+
+
+typedef AllocationTableLeaf<6> PageTables256KB;
+typedef AllocationTableDirectory<PageTables256KB, 6> PageTables16MB;
+typedef AllocationTableDirectory<LazyAllocationTable<PageTables16MB>, 1> PageTables32MB;
+typedef AllocationTableDirectory<LazyAllocationTable<PageTables16MB>, 6> PageTables1GB;
+
+#if CPU(ARM)
+typedef PageTables16MB FixedVMPoolPageTables;
+#elif CPU(X86_64)
+typedef PageTables1GB FixedVMPoolPageTables;
+#else
+typedef PageTables32MB FixedVMPoolPageTables;
+#endif
+
 
-    FixedVMPoolAllocator(size_t commonSize, size_t totalHeapSize)
-        : m_commonSize(commonSize)
-        , m_countFreedSinceLastCoalesce(0)
+class FixedVMPoolAllocator
+{
+public:
+    FixedVMPoolAllocator()
     {
-        m_allocation = PageReservation::reserve(totalHeapSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+        ASSERT(PageTables256KB::size() == 256 * 1024);
+        ASSERT(PageTables16MB::size() == 16 * 1024 * 1024);
+        ASSERT(PageTables32MB::size() == 32 * 1024 * 1024);
+        ASSERT(PageTables1GB::size() == 1024 * 1024 * 1024);
 
-        if (!!m_allocation)
-            m_freeList.insert(new FreeListEntry(m_allocation.base(), m_allocation.size()));
+        m_reservation = PageReservation::reserve(FixedVMPoolPageTables::size(), OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
 #if !ENABLE(INTERPRETER)
-        else
+        if (!isValid())
             CRASH();
 #endif
     }
-
-    ExecutablePool::Allocation alloc(size_t size)
+ 
+    ExecutablePool::Allocation alloc(size_t requestedSize)
     {
-        return ExecutablePool::Allocation(allocInternal(size), size);
+        ASSERT(requestedSize);
+        AllocationTableSizeClass sizeClass = classForSize(requestedSize);
+        size_t size = sizeClass.size();
+        ASSERT(size);
+
+        if (size >= FixedVMPoolPageTables::size())
+            CRASH();
+        if (m_pages.isFull())
+            CRASH();
+
+        size_t offset = m_pages.allocate(sizeClass);
+        if (offset == notFound)
+            CRASH();
+
+        void* pointer = offsetToPointer(offset);
+        m_reservation.commit(pointer, size);
+        return ExecutablePool::Allocation(pointer, size);
     }
 
     void free(ExecutablePool::Allocation allocation)
     {
         void* pointer = allocation.base();
         size_t size = allocation.size();
+        ASSERT(size);
 
-        ASSERT(!!m_allocation);
-        // Call release to report to the operating system that this
-        // memory is no longer in use, and need not be paged out.
-        ASSERT(isWithinVMPool(pointer, size));
-        release(pointer, size);
-
-        // Common-sized allocations are stored in the m_commonSizedAllocations
-        // vector; all other freed chunks are added to m_freeList.
-        if (size == m_commonSize)
-            m_commonSizedAllocations.append(pointer);
-        else
-            addToFreeList(new FreeListEntry(pointer, size));
-
-        // Do some housekeeping.  Every time we reach a point that
-        // 16MB of allocations have been freed, sweep m_freeList
-        // coalescing any neighboring fragments.
-        m_countFreedSinceLastCoalesce += size;
-        if (m_countFreedSinceLastCoalesce >= coalesceLimit) {
-            m_countFreedSinceLastCoalesce = 0;
-            coalesceFreeSpace();
-        }
+        m_reservation.decommit(pointer, size);
+
+        AllocationTableSizeClass sizeClass = classForSize(size);
+        ASSERT(sizeClass.size() == size);
+        m_pages.free(pointerToOffset(pointer), sizeClass);
     }
 
-    bool isValid() const { return !!m_allocation; }
+    size_t allocated()
+    {
+        return m_reservation.committed();
+    }
 
-private:
-    void* allocInternal(size_t size)
+    bool isValid() const
     {
-#if ENABLE(INTERPRETER)
-        if (!m_allocation)
-            return 0;
-#else
-        ASSERT(!!m_allocation);
-#endif
-        void* result;
-
-        // Freed allocations of the common size are not stored back into the main
-        // m_freeList, but are instead stored in a separate vector.  If the request
-        // is for a common sized allocation, check this list.
-        if ((size == m_commonSize) && m_commonSizedAllocations.size()) {
-            result = m_commonSizedAllocations.last();
-            m_commonSizedAllocations.removeLast();
-        } else {
-            // Search m_freeList for a suitable sized chunk to allocate memory from.
-            FreeListEntry* entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
-
-            // This would be bad news.
-            if (!entry) {
-                // Errk!  Lets take a last-ditch desperation attempt at defragmentation...
-                coalesceFreeSpace();
-                // Did that free up a large enough chunk?
-                entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
-                // No?...  *BOOM!*
-                if (!entry)
-                    CRASH();
-            }
-            ASSERT(entry->size != m_commonSize);
-
-            // Remove the entry from m_freeList.  But! -
-            // Each entry in the tree may represent a chain of multiple chunks of the
-            // same size, and we only want to remove one on them.  So, if this entry
-            // does have a chain, just remove the first-but-one item from the chain.
-            if (FreeListEntry* next = entry->nextEntry) {
-                // We're going to leave 'entry' in the tree; remove 'next' from its chain.
-                entry->nextEntry = next->nextEntry;
-                next->nextEntry = 0;
-                entry = next;
-            } else
-                m_freeList.remove(entry->size);
-
-            // Whoo!, we have a result!
-            ASSERT(entry->size >= size);
-            result = entry->pointer;
-
-            // If the allocation exactly fits the chunk we found in the,
-            // m_freeList then the FreeListEntry node is no longer needed.
-            if (entry->size == size)
-                delete entry;
-            else {
-                // There is memory left over, and it is not of the common size.
-                // We can reuse the existing FreeListEntry node to add this back
-                // into m_freeList.
-                entry->pointer = (void*)((intptr_t)entry->pointer + size);
-                entry->size -= size;
-                addToFreeList(entry);
-            }
-        }
+        return !!m_reservation;
+    }
 
-        // Call reuse to report to the operating system that this memory is in use.
-        ASSERT(isWithinVMPool(result, size));
-        reuse(result, size);
-        return result;
+private:
+    AllocationTableSizeClass classForSize(size_t size)
+    {
+        return FixedVMPoolPageTables::classForSize(size);
     }
 
-#ifndef NDEBUG
-    bool isWithinVMPool(void* pointer, size_t size)
+    void* offsetToPointer(size_t offset)
     {
-        return pointer >= m_allocation.base() && (reinterpret_cast<char*>(pointer) + size <= reinterpret_cast<char*>(m_allocation.base()) + m_allocation.size());
+        return reinterpret_cast<void*>(reinterpret_cast<intptr_t>(m_reservation.base()) + offset);
     }
-#endif
 
-    void addToCommittedByteCount(long byteCount)
+    size_t pointerToOffset(void* pointer)
     {
-        ASSERT(spinlock.IsHeld());
-        ASSERT(static_cast<long>(committedBytesCount) + byteCount > -1);
-        committedBytesCount += byteCount;
+        return reinterpret_cast<intptr_t>(pointer) - reinterpret_cast<intptr_t>(m_reservation.base());
     }
 
-    // Freed space from the most common sized allocations will be held in this list, ...
-    const size_t m_commonSize;
-    Vector<void*> m_commonSizedAllocations;
+    PageReservation m_reservation;
+    FixedVMPoolPageTables m_pages;
+};
 
-    // ... and all other freed allocations are held in m_freeList.
-    SizeSortedFreeTree m_freeList;
 
-    // This is used for housekeeping, to trigger defragmentation of the freed lists.
-    size_t m_countFreedSinceLastCoalesce;
+static SpinLock spinlock = SPINLOCK_INITIALIZER;
+static FixedVMPoolAllocator* allocator = 0;
 
-    PageReservation m_allocation;
-};
 
 size_t ExecutableAllocator::committedByteCount()
 {
     SpinLockHolder lockHolder(&spinlock);
-    return committedBytesCount;
+    return allocator ? allocator->allocated() : 0;
 }   
 
 void ExecutableAllocator::intializePageSize()
@@ -450,37 +496,11 @@ void ExecutableAllocator::intializePageSize()
     ExecutableAllocator::pageSize = getpagesize();
 }
 
-static FixedVMPoolAllocator* allocator = 0;
-static size_t allocatedCount = 0;
-
-#if OS(LINUX)
-static void maybeModifyVMPoolSize()
-{
-    FILE* fp = fopen("/proc/sys/vm/overcommit_memory", "r");
-    if (!fp)
-        return;
-
-    unsigned overcommit = 0;
-    if (fscanf(fp, "%u", &overcommit) == 1) {
-        if (overcommit == 1) {
-            vmPoolSize = vmPoolSizeOvercommit;
-            coalesceLimit = coalesceLimitOvercommit;
-        }
-    }
-
-    fclose(fp);
-}
-#endif
-
 bool ExecutableAllocator::isValid() const
 {
     SpinLockHolder lock_holder(&spinlock);
-    if (!allocator) {
-#if OS(LINUX)
-        maybeModifyVMPoolSize();
-#endif
-        allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, vmPoolSize);
-    }
+    if (!allocator)
+        allocator = new FixedVMPoolAllocator();
     return allocator->isValid();
 }
 
@@ -488,14 +508,13 @@ bool ExecutableAllocator::underMemoryPressure()
 {
     // Technically we should take the spin lock here, but we don't care if we get stale data.
     // This is only really a heuristic anyway.
-    return allocatedCount > (vmPoolSize / 2);
+    return allocator && (allocator->allocated() > (FixedVMPoolPageTables::size() / 2));
 }
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
 {
     SpinLockHolder lock_holder(&spinlock);
     ASSERT(allocator);
-    allocatedCount += size;
     return allocator->alloc(size);
 }
 
@@ -503,7 +522,6 @@ void ExecutablePool::systemRelease(ExecutablePool::Allocation& allocation)
 {
     SpinLockHolder lock_holder(&spinlock);
     ASSERT(allocator);
-    allocatedCount -= allocation.size();
     allocator->free(allocation);
 }
 
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index b8bd718..29e3778 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -587,22 +587,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     return patchBuffer.finalizeCode();
 }
 
-#if USE(JSVALUE64)
-void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
-{
-    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), dst);
-    loadPtr(Address(dst, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), dst);
-    loadPtr(Address(dst, index * sizeof(Register)), dst);
-}
-
-void JIT::emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index)
-{
-    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), variableObject);
-    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), variableObject);
-    storePtr(src, Address(variableObject, index * sizeof(Register)));
-}
-#endif
-
 #if ENABLE(JIT_OPTIMIZE_CALL)
 void JIT::unlinkCallOrConstruct(CallLinkInfo* callLinkInfo)
 {
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 45ed436..dc1650d 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -505,9 +505,6 @@ namespace JSC {
 
         int32_t getConstantOperandImmediateInt(unsigned src);
 
-        void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
-        void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
-        
         void killLastResultRegister();
 
         Jump emitJumpIfJSCell(RegisterID);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 98cb2f3..f458ea2 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -455,8 +455,8 @@ void JIT::emit_op_construct(Instruction* currentInstruction)
 void JIT::emit_op_get_global_var(Instruction* currentInstruction)
 {
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    move(ImmPtr(globalObject), regT0);
-    emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
+    loadPtr(&globalObject->d->registers, regT0);
+    loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -464,8 +464,8 @@ void JIT::emit_op_put_global_var(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    move(ImmPtr(globalObject), regT0);
-    emitPutVariableObjectRegister(regT1, regT0, currentInstruction[1].u.operand);
+    loadPtr(&globalObject->d->registers, regT0);
+    storePtr(regT1, Address(regT0, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
 void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
@@ -486,7 +486,9 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT0);
-    emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject, d)), regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT0);
+    loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -509,7 +511,9 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
 
     loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
-    emitPutVariableObjectRegister(regT0, regT1, currentInstruction[1].u.operand);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject, d)), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT1);
+    storePtr(regT0, Address(regT1, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
 void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 9126ea7..74f505f 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -221,7 +221,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && CPU(ARM_THUMB2)
+#elif (COMPILER(GCC) || COMPILER(RVCT)) && CPU(ARM_THUMB2)
 
 #define THUNK_RETURN_ADDRESS_OFFSET      0x38
 #define PRESERVED_RETURN_ADDRESS_OFFSET  0x3C
@@ -321,58 +321,7 @@ extern "C" {
 
 #else // USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && CPU(X86)
-
-// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
-// need to change the assembly trampolines below to match.
-COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
-
-asm (
-".text\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushl %ebp" "\n"
-    "movl %esp, %ebp" "\n"
-    "pushl %esi" "\n"
-    "pushl %edi" "\n"
-    "pushl %ebx" "\n"
-    "subl $0x1c, %esp" "\n"
-    "movl $512, %esi" "\n"
-    "movl 0x38(%esp), %edi" "\n"
-    "call *0x30(%esp)" "\n"
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-
-asm (
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "movl %esp, %ecx" "\n"
-    "call " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "int3" "\n"
-);
-    
-asm (
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(GCC) && CPU(X86_64)
+#if COMPILER(GCC) && CPU(X86_64)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -438,97 +387,6 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && CPU(ARM_THUMB2)
-
-#define THUNK_RETURN_ADDRESS_OFFSET      0x20
-#define PRESERVED_RETURN_ADDRESS_OFFSET  0x24
-#define PRESERVED_R4_OFFSET              0x28
-#define PRESERVED_R5_OFFSET              0x2C
-#define PRESERVED_R6_OFFSET              0x30
-#define REGISTER_FILE_OFFSET             0x34
-#define CALLFRAME_OFFSET                 0x38
-#define EXCEPTION_OFFSET                 0x3C
-#define ENABLE_PROFILER_REFERENCE_OFFSET 0x40
-
-#elif (COMPILER(GCC) || COMPILER(RVCT)) && CPU(ARM_TRADITIONAL)
-
-#define THUNK_RETURN_ADDRESS_OFFSET 32
-#define PRESERVEDR4_OFFSET          36
-
-#elif CPU(MIPS)
-
-#define PRESERVED_GP_OFFSET         28
-#define PRESERVED_S0_OFFSET         32
-#define PRESERVED_S1_OFFSET         36
-#define PRESERVED_S2_OFFSET         40
-#define PRESERVED_RETURN_ADDRESS_OFFSET 44
-#define THUNK_RETURN_ADDRESS_OFFSET 48
-#define REGISTER_FILE_OFFSET        52
-#define CALLFRAME_OFFSET            56
-#define EXCEPTION_OFFSET            60
-#define ENABLE_PROFILER_REFERENCE_OFFSET 64
-#define GLOBAL_DATA_OFFSET          68
-#define STACK_LENGTH                72
-
-#elif COMPILER(MSVC) && CPU(X86)
-
-// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
-// need to change the assembly trampolines below to match.
-COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
-
-extern "C" {
-
-    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*)
-    {
-        __asm {
-            push ebp;
-            mov ebp, esp;
-            push esi;
-            push edi;
-            push ebx;
-            sub esp, 0x1c;
-            mov esi, 512;
-            mov ecx, esp;
-            mov edi, [esp + 0x38];
-            call [esp + 0x30];
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-
-    __declspec(naked) void ctiVMThrowTrampoline()
-    {
-        __asm {
-            mov ecx, esp;
-            call cti_vm_throw;
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-     
-     __declspec(naked) void ctiOpThrowNotCaught()
-     {
-         __asm {
-             add esp, 0x1c;
-             pop ebx;
-             pop edi;
-             pop esi;
-             pop ebp;
-             ret;
-         }
-     }
-}
-
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -987,7 +845,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
-            slotBaseObject->flattenDictionaryObject();
+            slotBaseObject->flattenDictionaryObject(callFrame->globalData());
             offset = slotBaseObject->structure()->get(propertyName);
         }
         
@@ -1084,17 +942,17 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception)) \
+        if (UNLIKELY(stackFrame.globalData->exception.get())) \
             VM_THROW_EXCEPTION(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_AT_END() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception)) \
+        if (UNLIKELY(stackFrame.globalData->exception.get())) \
             VM_THROW_EXCEPTION_AT_END(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_VOID() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception)) { \
+        if (UNLIKELY(stackFrame.globalData->exception.get())) { \
             VM_THROW_EXCEPTION_AT_END(); \
             return; \
         } \
@@ -1608,7 +1466,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->flattenDictionaryObject();
+            slotBaseObject->flattenDictionaryObject(callFrame->globalData());
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
@@ -1798,7 +1656,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
-            slotBaseObject->flattenDictionaryObject();
+            slotBaseObject->flattenDictionaryObject(callFrame->globalData());
             offset = slotBaseObject->structure()->get(propertyName);
         }
 
@@ -2289,7 +2147,7 @@ DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
     activation->copyRegisters();
     if (JSValue v = stackFrame.args[1].jsValue()) {
         if (!stackFrame.callFrame->codeBlock()->isStrictMode())
-            asArguments(v)->setActivation(activation);
+            asArguments(v)->setActivation(*stackFrame.globalData, activation);
     }
 }
 
@@ -2346,7 +2204,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
 
     Identifier& ident = stackFrame.args[0].identifier();
     do {
-        JSObject* o = *iter;
+        JSObject* o = iter->get();
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
@@ -2539,7 +2397,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
         if (isJSArray(globalData, baseValue)) {
             JSArray* jsArray = asArray(baseValue);
             if (jsArray->canSetIndex(i))
-                jsArray->setIndex(i, value);
+                jsArray->setIndex(*globalData, i, value);
             else
                 jsArray->JSArray::put(callFrame, i, value);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
@@ -2787,7 +2645,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
     }
     Identifier& ident = stackFrame.args[0].identifier();
     do {
-        JSObject* o = *iter;
+        JSObject* o = iter->get();
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
@@ -3116,7 +2974,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
     Identifier& ident = stackFrame.args[0].identifier();
     JSObject* base;
     do {
-        base = *iter;
+        base = iter->get();
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
@@ -3622,7 +3480,7 @@ DEFINE_STUB_FUNCTION(void*, vm_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     JSGlobalData* globalData = stackFrame.globalData;
-    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception, globalData->exceptionLocation);
+    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception.get(), globalData->exceptionLocation);
     STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
     return handler.callFrame;
 }
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index dd4b677..912b51a 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -169,7 +169,7 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
     JSObject* array = constructEmptyArray(globalExec());
     for (size_t i = 0; i < arguments.size(); ++i)
         array->put(globalExec(), i, jsString(globalExec(), arguments[i]));
-    putDirect(Identifier(globalExec(), "arguments"), array);
+    putDirect(globalExec()->globalData(), Identifier(globalExec(), "arguments"), array);
 }
 
 EncodedJSValue JSC_HOST_CALL functionPrint(ExecState* exec)
diff --git a/Source/JavaScriptCore/jsc.pro b/Source/JavaScriptCore/jsc.pro
index 7c90f37..b4db812 100644
--- a/Source/JavaScriptCore/jsc.pro
+++ b/Source/JavaScriptCore/jsc.pro
@@ -9,7 +9,7 @@ win32-*: CONFIG += console
 win32-msvc*: CONFIG += exceptions_off stl_off
 
 isEmpty(OUTPUT_DIR): OUTPUT_DIR= ..
-include($$PWD/../../WebKit.pri)
+include($$PWD/../WebKit.pri)
 
 unix:!mac:!symbian:CONFIG += link_pkgconfig
 
diff --git a/Source/JavaScriptCore/parser/JSParser.cpp b/Source/JavaScriptCore/parser/JSParser.cpp
index cb59f93..993dd66 100644
--- a/Source/JavaScriptCore/parser/JSParser.cpp
+++ b/Source/JavaScriptCore/parser/JSParser.cpp
@@ -34,6 +34,7 @@ using namespace JSC;
 #include "NodeInfo.h"
 #include "ASTBuilder.h"
 #include "SourceProvider.h"
+#include "SourceProviderCacheItem.h"
 #include <wtf/HashFunctions.h>
 #include <wtf/WTFThreadData.h>
 #include <utility>
@@ -96,39 +97,6 @@ private:
         bool m_isLoop;
     };
     
-    struct CachedFunctionInfo : public SourceProviderCache::Item {
-        CachedFunctionInfo(int closeBraceLine, int closeBracePos)
-            : closeBraceLine(closeBraceLine) 
-            , closeBracePos(closeBracePos)
-        {
-        }
-        unsigned approximateByteSize() const
-        {
-            // The identifiers are uniqued strings so most likely there are few names that actually use any additional memory.
-            static const unsigned assummedAverageIdentifierSize = sizeof(RefPtr<StringImpl>) + 2;
-            unsigned size = sizeof(*this);
-            size += usedVariables.size() * assummedAverageIdentifierSize;
-            size += writtenVariables.size() * assummedAverageIdentifierSize;
-            return size;
-        }
-        JSToken closeBraceToken() const 
-        {
-            JSToken token;
-            token.m_type = CLOSEBRACE;
-            token.m_data.intValue = closeBracePos;
-            token.m_info.startOffset = closeBracePos;
-            token.m_info.endOffset = closeBracePos + 1;
-            token.m_info.line = closeBraceLine; 
-            return token;
-        }
-
-        int closeBraceLine;
-        int closeBracePos;
-        bool usesEval;
-        Vector<RefPtr<StringImpl> > usedVariables;
-        Vector<RefPtr<StringImpl> > writtenVariables;
-    };
-
     void next(Lexer::LexType lexType = Lexer::IdentifyReservedWords)
     {
         m_lastLine = m_token.m_info.line;
@@ -463,7 +431,7 @@ private:
             vector.shrinkToFit();
         }
 
-        void saveFunctionInfo(CachedFunctionInfo* info)
+        void saveFunctionInfo(SourceProviderCacheItem* info)
         {
             ASSERT(m_isFunction);
             info->usesEval = m_usesEval;
@@ -471,7 +439,7 @@ private:
             copyCapturedVariablesToVector(m_usedVariables, info->usedVariables);
         }
 
-        void restoreFunctionInfo(const CachedFunctionInfo* info)
+        void restoreFunctionInfo(const SourceProviderCacheItem* info)
         {
             ASSERT(m_isFunction);
             m_usesEval = info->usesEval;
@@ -609,9 +577,9 @@ private:
 
     ScopeStack m_scopeStack;
 
-    const CachedFunctionInfo* findCachedFunctionInfo(int openBracePos) 
+    const SourceProviderCacheItem* findCachedFunctionInfo(int openBracePos) 
     {
-        return m_functionCache ? static_cast<const CachedFunctionInfo*>(m_functionCache->get(openBracePos)) : 0;
+        return m_functionCache ? m_functionCache->get(openBracePos) : 0;
     }
 
     SourceProviderCache* m_functionCache;
@@ -1318,7 +1286,7 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
     openBracePos = m_token.m_data.intValue;
     bodyStartLine = tokenLine();
 
-    if (const CachedFunctionInfo* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(openBracePos) : 0) {
+    if (const SourceProviderCacheItem* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(openBracePos) : 0) {
         // If we know about this function already, we can use the cached info and skip the parser to the end of the function.
         body = context.createFunctionBody(strictMode());
 
@@ -1347,10 +1315,10 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
     // Cache the tokenizer state and the function scope the first time the function is parsed.
     // Any future reparsing can then skip the function.
     static const int minimumFunctionLengthToCache = 64;
-    OwnPtr<CachedFunctionInfo> newInfo;
+    OwnPtr<SourceProviderCacheItem> newInfo;
     int functionLength = closeBracePos - openBracePos;
     if (TreeBuilder::CanUseFunctionCache && m_functionCache && functionLength > minimumFunctionLengthToCache) {
-        newInfo = adoptPtr(new CachedFunctionInfo(m_token.m_info.line, closeBracePos));
+        newInfo = adoptPtr(new SourceProviderCacheItem(m_token.m_info.line, closeBracePos));
         functionScope->saveFunctionInfo(newInfo.get());
     }
     
diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
index bcc445b..e9b6b56 100644
--- a/Source/JavaScriptCore/parser/SourceProvider.h
+++ b/Source/JavaScriptCore/parser/SourceProvider.h
@@ -29,32 +29,15 @@
 #ifndef SourceProvider_h
 #define SourceProvider_h
 
+#include "SourceProviderCache.h"
 #include "UString.h"
-#include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/TextPosition.h>
 
-
 namespace JSC {
 
-    class SourceProviderCache {
-    public:
-        struct Item {};
-
-        SourceProviderCache() : m_contentByteSize(0) {}
-        ~SourceProviderCache() { deleteAllValues(m_map); }
-        
-        unsigned byteSize() const { return m_contentByteSize + sizeof(*this) + m_map.capacity() * sizeof(Item*); } 
-        void add(int sourcePosition, PassOwnPtr<Item> item, unsigned size) { m_map.add(sourcePosition, item.leakPtr()); m_contentByteSize += size; }
-        const Item* get(int sourcePosition) const { return m_map.get(sourcePosition); }
-
-    private:
-        HashMap<int, Item*> m_map;
-        unsigned m_contentByteSize;
-    };
-
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
         SourceProvider(const UString& url, SourceProviderCache* cache = 0)
diff --git a/Source/JavaScriptCore/parser/SourceProviderCache.cpp b/Source/JavaScriptCore/parser/SourceProviderCache.cpp
new file mode 100644
index 0000000..afeec52
--- /dev/null
+++ b/Source/JavaScriptCore/parser/SourceProviderCache.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#include "config.h"
+#include "SourceProviderCache.h"
+
+#include "SourceProviderCacheItem.h"
+
+namespace JSC {
+
+SourceProviderCache::~SourceProviderCache()
+{
+    clear();
+}
+
+void SourceProviderCache::clear()
+{
+    deleteAllValues(m_map);
+    m_map.clear();
+    m_contentByteSize = 0;
+}
+
+unsigned SourceProviderCache::byteSize() const
+{ 
+    return m_contentByteSize + sizeof(*this) + m_map.capacity() * sizeof(SourceProviderCacheItem*);
+}
+
+void SourceProviderCache::add(int sourcePosition, PassOwnPtr<SourceProviderCacheItem> item, unsigned size)
+{
+    m_map.add(sourcePosition, item.leakPtr());
+    m_contentByteSize += size;
+}
+
+}
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h b/Source/JavaScriptCore/parser/SourceProviderCache.h
index 0113aff..4df46f7 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,18 +23,26 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WTF_OwnArrayPtrCommon_h
-#define WTF_OwnArrayPtrCommon_h
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 
-namespace WTF {
+namespace JSC {
 
-template<typename T> inline void deleteOwnedArrayPtr(T* ptr)
-{
-    typedef char known[sizeof(T) ? 1 : -1];
-    if (sizeof(known))
-        delete [] ptr;
-}
+class SourceProviderCacheItem;
+
+class SourceProviderCache {
+public:
+    SourceProviderCache() : m_contentByteSize(0) {}
+    ~SourceProviderCache();
 
-} // namespace WTF
+    void clear();
+    unsigned byteSize() const;
+    void add(int sourcePosition, PassOwnPtr<SourceProviderCacheItem>, unsigned size);
+    const SourceProviderCacheItem* get(int sourcePosition) const { return m_map.get(sourcePosition); }
 
-#endif // WTF_OwnArrayPtrCommon_h
+private:
+    HashMap<int, SourceProviderCacheItem*> m_map;
+    unsigned m_contentByteSize;
+};
+
+}
diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
new file mode 100644
index 0000000..b9ab225
--- /dev/null
+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "JSParser.h"
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class SourceProviderCacheItem {
+public:
+    SourceProviderCacheItem(int closeBraceLine, int closeBracePos)
+        : closeBraceLine(closeBraceLine) 
+        , closeBracePos(closeBracePos)
+    {
+    }
+    unsigned approximateByteSize() const
+    {
+        // The identifiers are uniqued strings so most likely there are few names that actually use any additional memory.
+        static const unsigned assummedAverageIdentifierSize = sizeof(RefPtr<StringImpl>) + 2;
+        unsigned size = sizeof(*this);
+        size += usedVariables.size() * assummedAverageIdentifierSize;
+        size += writtenVariables.size() * assummedAverageIdentifierSize;
+        return size;
+    }
+    JSToken closeBraceToken() const 
+    {
+        JSToken token;
+        token.m_type = CLOSEBRACE;
+        token.m_data.intValue = closeBracePos;
+        token.m_info.startOffset = closeBracePos;
+        token.m_info.endOffset = closeBracePos + 1;
+        token.m_info.line = closeBraceLine; 
+        return token;
+    }
+    
+    int closeBraceLine;
+    int closeBracePos;
+    bool usesEval;
+    Vector<RefPtr<StringImpl> > usedVariables;
+    Vector<RefPtr<StringImpl> > writtenVariables;
+};
+
+}
diff --git a/Source/JavaScriptCore/pcre/AUTHORS b/Source/JavaScriptCore/pcre/AUTHORS
deleted file mode 100644
index dbac2a5..0000000
--- a/Source/JavaScriptCore/pcre/AUTHORS
+++ /dev/null
@@ -1,12 +0,0 @@
-Originally written by:  Philip Hazel
-Email local part:       ph10
-Email domain:           cam.ac.uk
-
-University of Cambridge Computing Service,
-Cambridge, England. Phone: +44 1223 334714.
-
-Copyright (c) 1997-2005 University of Cambridge. All rights reserved.
-
-Adapted for JavaScriptCore and WebKit by Apple Inc.
-
-Copyright (c) 2005, 2006, 2007 Apple Inc. All rights reserved.
diff --git a/Source/JavaScriptCore/pcre/COPYING b/Source/JavaScriptCore/pcre/COPYING
deleted file mode 100644
index 6ffdc24..0000000
--- a/Source/JavaScriptCore/pcre/COPYING
+++ /dev/null
@@ -1,35 +0,0 @@
-PCRE is a library of functions to support regular expressions whose syntax
-and semantics are as close as possible to those of the Perl 5 language.
-
-This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed.
-
-Copyright (c) 1997-2005 University of Cambridge. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the name of Apple
-      Inc. nor the names of their contributors may be used to endorse or
-      promote products derived from this software without specific prior
-      written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
diff --git a/Source/JavaScriptCore/pcre/dftables b/Source/JavaScriptCore/pcre/dftables
deleted file mode 100755
index 669b948..0000000
--- a/Source/JavaScriptCore/pcre/dftables
+++ /dev/null
@@ -1,273 +0,0 @@
-#!/usr/bin/perl -w
-#
-# This is JavaScriptCore's variant of the PCRE library. While this library
-# started out as a copy of PCRE, many of the features of PCRE have been
-# removed. This library now supports only the regular expression features
-# required by the JavaScript language specification, and has only the functions
-# needed by JavaScriptCore and the rest of WebKit.
-# 
-#                  Originally written by Philip Hazel
-#            Copyright (c) 1997-2006 University of Cambridge
-#  Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
-# 
-# -----------------------------------------------------------------------------
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are met:
-# 
-#     * Redistributions of source code must retain the above copyright notice,
-#       this list of conditions and the following disclaimer.
-# 
-#     * Redistributions in binary form must reproduce the above copyright
-#       notice, this list of conditions and the following disclaimer in the
-#       documentation and/or other materials provided with the distribution.
-# 
-#     * Neither the name of the University of Cambridge nor the names of its
-#       contributors may be used to endorse or promote products derived from
-#       this software without specific prior written permission.
-# 
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-# POSSIBILITY OF SUCH DAMAGE.
-# -----------------------------------------------------------------------------
-
-# This is a freestanding support program to generate a file containing
-# character tables. The tables are built according to the default C
-# locale.
-
-use strict;
-
-use File::Basename;
-use File::Spec;
-use File::Temp qw(tempfile);
-use Getopt::Long;
-
-sub readHeaderValues();
-
-my %pcre_internal;
-
-if (scalar(@ARGV) < 1) {
-    print STDERR "Usage: ", basename($0), " [--preprocessor=program] output-file\n";
-    exit 1;
-}
-
-my $outputFile;
-my $preprocessor;
-GetOptions('preprocessor=s' => \$preprocessor);
-if (not $preprocessor) {
-    $preprocessor = "cpp";
-}
-
-$outputFile = $ARGV[0];
-die('Must specify output file.') unless defined($outputFile);
-
-readHeaderValues();
-
-open(OUT, ">", $outputFile) or die "$!";
-binmode(OUT);
-
-printf(OUT
-    "/*************************************************\n" .
-    "*      Perl-Compatible Regular Expressions       *\n" .
-    "*************************************************/\n\n" .
-    "/* This file is automatically written by the dftables auxiliary \n" .
-    "program. If you edit it by hand, you might like to edit the Makefile to \n" .
-    "prevent its ever being regenerated.\n\n");
-printf(OUT
-    "This file contains the default tables for characters with codes less than\n" .
-    "128 (ASCII characters). These tables are used when no external tables are\n" .
-    "passed to PCRE. */\n\n" .
-    "const unsigned char jsc_pcre_default_tables[%d] = {\n\n" .
-    "/* This table is a lower casing table. */\n\n", $pcre_internal{tables_length});
-
-if ($pcre_internal{lcc_offset} != 0) {
-    die "lcc_offset != 0";
-}
-
-printf(OUT "  ");
-for (my $i = 0; $i < 128; $i++) {
-    if (($i & 7) == 0 && $i != 0) {
-        printf(OUT "\n  ");
-    }
-    printf(OUT "0x%02X", ord(lc(chr($i))));
-    if ($i != 127) {
-        printf(OUT ", ");
-    }
-}
-printf(OUT ",\n\n");
-
-printf(OUT "/* This table is a case flipping table. */\n\n");
-
-if ($pcre_internal{fcc_offset} != 128) {
-  die "fcc_offset != 128";
-}
-
-printf(OUT "  ");
-for (my $i = 0; $i < 128; $i++) {
-    if (($i & 7) == 0 && $i != 0) {
-        printf(OUT "\n  ");
-    }
-    my $c = chr($i);
-    printf(OUT "0x%02X", $c =~ /[[:lower:]]/ ? ord(uc($c)) : ord(lc($c)));
-    if ($i != 127) {
-        printf(OUT ", ");
-    }
-}
-printf(OUT ",\n\n");
-
-printf(OUT
-    "/* This table contains bit maps for various character classes.\n" .
-    "Each map is 32 bytes long and the bits run from the least\n" .
-    "significant end of each byte. The classes are: space, digit, word. */\n\n");
-
-if ($pcre_internal{cbits_offset} != $pcre_internal{fcc_offset} + 128) {
-    die "cbits_offset != fcc_offset + 128";
-}
-
-my @cbit_table = (0) x $pcre_internal{cbit_length};
-for (my $i = ord('0'); $i <= ord('9'); $i++) {
-    $cbit_table[$pcre_internal{cbit_digit} + $i / 8] |= 1 << ($i & 7);
-}
-$cbit_table[$pcre_internal{cbit_word} + ord('_') / 8] |= 1 << (ord('_') & 7);
-for (my $i = 0; $i < 128; $i++) {
-    my $c = chr($i);
-    if ($c =~ /[[:alnum:]]/) {
-        $cbit_table[$pcre_internal{cbit_word} + $i / 8] |= 1 << ($i & 7);
-    }
-    if ($c =~ /[[:space:]]/) {
-        $cbit_table[$pcre_internal{cbit_space} + $i / 8] |= 1 << ($i & 7);
-    }
-}
-
-printf(OUT "  ");
-for (my $i = 0; $i < $pcre_internal{cbit_length}; $i++) {
-    if (($i & 7) == 0 && $i != 0) {
-        if (($i & 31) == 0) {
-            printf(OUT "\n");
-        }
-        printf(OUT "\n  ");
-    }
-    printf(OUT "0x%02X", $cbit_table[$i]);
-    if ($i != $pcre_internal{cbit_length} - 1) {
-        printf(OUT ", ");
-    }
-}
-printf(OUT ",\n\n");
-
-printf(OUT
-    "/* This table identifies various classes of character by individual bits:\n" .
-    "  0x%02x   white space character\n" .
-    "  0x%02x   hexadecimal digit\n" .
-    "  0x%02x   alphanumeric or '_'\n*/\n\n",
-    $pcre_internal{ctype_space}, $pcre_internal{ctype_xdigit}, $pcre_internal{ctype_word});
-
-if ($pcre_internal{ctypes_offset} != $pcre_internal{cbits_offset} + $pcre_internal{cbit_length}) {
-    die "ctypes_offset != cbits_offset + cbit_length";
-}
-
-printf(OUT "  ");
-for (my $i = 0; $i < 128; $i++) {
-    my $x = 0;
-    my $c = chr($i);
-    if ($c =~ /[[:space:]]/) {
-        $x += $pcre_internal{ctype_space};
-    }
-    if ($c =~ /[[:xdigit:]]/) {
-        $x += $pcre_internal{ctype_xdigit};
-    }
-    if ($c =~ /[[:alnum:]_]/) {
-        $x += $pcre_internal{ctype_word};
-    }
-    printf(OUT "0x%02X", $x);
-    if ($i != 127) {
-        printf(OUT ", ");
-    } else {
-        printf(OUT "};");
-    }
-    if (($i & 7) == 7) {
-        printf(OUT " /* ");
-        my $d = chr($i - 7);
-        if ($d =~ /[[:print:]]/) {
-            printf(OUT " %c -", $i - 7);
-        } else {
-            printf(OUT "%3d-", $i - 7);
-        }
-        if ($c =~ m/[[:print:]]/) {
-            printf(OUT " %c ", $i);
-        } else {
-            printf(OUT "%3d", $i);
-        }
-        printf(OUT " */\n");
-        if ($i != 127) {
-            printf(OUT "  ");
-        }
-    }
-}
-
-if ($pcre_internal{tables_length} != $pcre_internal{ctypes_offset} + 128) {
-    die "tables_length != ctypes_offset + 128";
-}
-
-printf(OUT "\n\n/* End of chartables.c */\n");
-
-close(OUT);
-
-exit 0;
-
-sub readHeaderValues()
-{
-    my @variables = qw(
-        cbit_digit
-        cbit_length
-        cbit_space
-        cbit_word
-        cbits_offset
-        ctype_space
-        ctype_word
-        ctype_xdigit
-        ctypes_offset
-        fcc_offset
-        lcc_offset
-        tables_length
-    );
-
-    local $/ = undef;
-
-    my $headerPath = File::Spec->catfile(dirname($0), "pcre_internal.h");
- 
-    my ($fh, $tempFile) = tempfile(
-        basename($0) . "-XXXXXXXX",
-        DIR => File::Spec->tmpdir(),
-        SUFFIX => ".in",
-        UNLINK => 0,
-    );
-
-    print $fh "#define DFTABLES\n\n";
-
-    open(HEADER, "<", $headerPath) or die "$!";
-    print $fh <HEADER>;
-    close(HEADER);
-
-    print $fh "\n\n";
-
-    for my $v (@variables) {
-        print $fh "\$pcre_internal{\"$v\"} = $v;\n";
-    }
-
-    close($fh);
-
-    open(CPP, "$preprocessor \"$tempFile\" |") or die "$!";
-    my $content = <CPP>;
-    close(CPP);
-    
-    eval $content;
-    die "$@" if $@;
-    unlink $tempFile;
-}
diff --git a/Source/JavaScriptCore/pcre/pcre.h b/Source/JavaScriptCore/pcre/pcre.h
deleted file mode 100644
index 55044fd..0000000
--- a/Source/JavaScriptCore/pcre/pcre.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/* This is the public header file for JavaScriptCore's variant of the PCRE
-library. While this library started out as a copy of PCRE, many of the
-features of PCRE have been removed. This library now supports only the
-regular expression features required by the JavaScript language
-specification, and has only the functions needed by JavaScriptCore and the
-rest of WebKit.
-
-           Copyright (c) 1997-2005 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-// FIXME: This file needs to be renamed to JSRegExp.h; it's no longer PCRE.
-
-#ifndef JSRegExp_h
-#define JSRegExp_h
-
-#include <wtf/unicode/Unicode.h>
-
-struct JSRegExp;
-
-enum JSRegExpIgnoreCaseOption { JSRegExpDoNotIgnoreCase, JSRegExpIgnoreCase };
-enum JSRegExpMultilineOption { JSRegExpSingleLine, JSRegExpMultiline };
-
-/* jsRegExpExecute error codes */
-const int JSRegExpErrorNoMatch = -1;
-const int JSRegExpErrorHitLimit = -2;
-const int JSRegExpErrorNoMemory = -3;
-const int JSRegExpErrorInternal = -4;
-
-JSRegExp* jsRegExpCompile(const UChar* pattern, int patternLength,
-    JSRegExpIgnoreCaseOption, JSRegExpMultilineOption,
-    unsigned* numSubpatterns, const char** errorMessage);
-
-int jsRegExpExecute(const JSRegExp*,
-    const UChar* subject, int subjectLength, int startOffset,
-    int* offsetsVector, int offsetsVectorLength);
-
-void jsRegExpFree(JSRegExp*);
-
-#endif
diff --git a/Source/JavaScriptCore/pcre/pcre.pri b/Source/JavaScriptCore/pcre/pcre.pri
deleted file mode 100644
index 3652d95..0000000
--- a/Source/JavaScriptCore/pcre/pcre.pri
+++ /dev/null
@@ -1,12 +0,0 @@
-# Perl Compatible Regular Expressions - Qt4 build info
-VPATH += $$PWD
-INCLUDEPATH += $$PWD $$OUTPUT_DIR/Source/JavaScriptCore/generated
-DEPENDPATH += $$PWD
-
-SOURCES += \
-    pcre_compile.cpp \
-    pcre_exec.cpp \
-    pcre_tables.cpp \
-    pcre_ucp_searchfuncs.cpp \
-    pcre_xclass.cpp
-
diff --git a/Source/JavaScriptCore/pcre/pcre_compile.cpp b/Source/JavaScriptCore/pcre/pcre_compile.cpp
deleted file mode 100644
index 9d472d8..0000000
--- a/Source/JavaScriptCore/pcre/pcre_compile.cpp
+++ /dev/null
@@ -1,2708 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/* This module contains the external function jsRegExpExecute(), along with
-supporting internal functions that are not used by other modules. */
-
-#include "config.h"
-
-#include "pcre_internal.h"
-
-#include <string.h>
-#include <wtf/ASCIICType.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/FixedArray.h>
-#include <wtf/StdLibExtras.h>
-
-using namespace WTF;
-
-/* Negative values for the firstchar and reqchar variables */
-
-#define REQ_UNSET (-2)
-#define REQ_NONE  (-1)
-
-/*************************************************
-*      Code parameters and static tables         *
-*************************************************/
-
-/* Maximum number of items on the nested bracket stacks at compile time. This
-applies to the nesting of all kinds of parentheses. It does not limit
-un-nested, non-capturing parentheses. This number can be made bigger if
-necessary - it is used to dimension one int and one unsigned char vector at
-compile time. */
-
-#define BRASTACK_SIZE 200
-
-/* Table for handling escaped characters in the range '0'-'z'. Positive returns
-are simple data values; negative values are for special things like \d and so
-on. Zero means further processing is needed (for things like \x), or the escape
-is invalid. */
-
-static const short escapes[] = {
-     0,      0,      0,      0,      0,      0,      0,      0,   /* 0 - 7 */
-     0,      0,    ':',    ';',    '<',    '=',    '>',    '?',   /* 8 - ? */
-   '@',      0, -ESC_B,      0, -ESC_D,      0,      0,      0,   /* @ - G */
-     0,      0,      0,      0,      0,      0,      0,      0,   /* H - O */
-     0,      0,      0, -ESC_S,      0,      0,      0, -ESC_W,   /* P - W */
-     0,      0,      0,    '[',   '\\',    ']',    '^',    '_',   /* X - _ */
-   '`',      7, -ESC_b,      0, -ESC_d,      0,   '\f',      0,   /* ` - g */
-     0,      0,      0,      0,      0,      0,   '\n',      0,   /* h - o */
-     0,      0,    '\r', -ESC_s,   '\t',      0,  '\v', -ESC_w,   /* p - w */
-     0,      0,      0                                            /* x - z */
-};
-
-/* Error code numbers. They are given names so that they can more easily be
-tracked. */
-
-enum ErrorCode {
-    ERR0, ERR1, ERR2, ERR3, ERR4, ERR5, ERR6, ERR7, ERR8, ERR9,
-    ERR10, ERR11, ERR12, ERR13, ERR14, ERR15, ERR16, ERR17
-};
-
-/* The texts of compile-time error messages. These are "char *" because they
-are passed to the outside world. */
-
-static const char* errorText(ErrorCode code)
-{
-    static const char errorTexts[] =
-      /* 1 */
-      "\\ at end of pattern\0"
-      "\\c at end of pattern\0"
-      "character value in \\x{...} sequence is too large\0"
-      "numbers out of order in {} quantifier\0"
-      /* 5 */
-      "number too big in {} quantifier\0"
-      "missing terminating ] for character class\0"
-      "internal error: code overflow\0"
-      "range out of order in character class\0"
-      "nothing to repeat\0"
-      /* 10 */
-      "unmatched parentheses\0"
-      "internal error: unexpected repeat\0"
-      "unrecognized character after (?\0"
-      "failed to get memory\0"
-      "missing )\0"
-      /* 15 */
-      "reference to non-existent subpattern\0"
-      "regular expression too large\0"
-      "parentheses nested too deeply"
-    ;
-
-    int i = code;
-    const char* text = errorTexts;
-    while (i > 1)
-        i -= !*text++;
-    return text;
-}
-
-/* Structure for passing "static" information around between the functions
-doing the compiling. */
-
-struct CompileData {
-    CompileData() {
-        topBackref = 0;
-        backrefMap = 0;
-        reqVaryOpt = 0;
-        needOuterBracket = false;
-        numCapturingBrackets = 0;
-    }
-    int topBackref;            /* Maximum back reference */
-    unsigned backrefMap;       /* Bitmap of low back refs */
-    int reqVaryOpt;            /* "After variable item" flag for reqByte */
-    bool needOuterBracket;
-    int numCapturingBrackets;
-};
-
-/* Definitions to allow mutual recursion */
-
-static bool compileBracket(int, int*, unsigned char**, const UChar**, const UChar*, ErrorCode*, int, int*, int*, CompileData&);
-static bool bracketIsAnchored(const unsigned char* code);
-static bool bracketNeedsLineStart(const unsigned char* code, unsigned captureMap, unsigned backrefMap);
-static int bracketFindFirstAssertedCharacter(const unsigned char* code, bool inassert);
-
-/*************************************************
-*            Handle escapes                      *
-*************************************************/
-
-/* This function is called when a \ has been encountered. It either returns a
-positive value for a simple escape such as \n, or a negative value which
-encodes one of the more complicated things such as \d. When UTF-8 is enabled,
-a positive value greater than 255 may be returned. On entry, ptr is pointing at
-the \. On exit, it is on the final character of the escape sequence.
-
-Arguments:
-  ptrPtr         points to the pattern position pointer
-  errorCodePtr   points to the errorcode variable
-  bracount       number of previous extracting brackets
-  options        the options bits
-  isClass        true if inside a character class
-
-Returns:         zero or positive => a data character
-                 negative => a special escape sequence
-                 on error, errorPtr is set
-*/
-
-static int checkEscape(const UChar** ptrPtr, const UChar* patternEnd, ErrorCode* errorCodePtr, int bracount, bool isClass)
-{
-    const UChar* ptr = *ptrPtr + 1;
-
-    /* If backslash is at the end of the pattern, it's an error. */
-    if (ptr == patternEnd) {
-        *errorCodePtr = ERR1;
-        *ptrPtr = ptr;
-        return 0;
-    }
-    
-    int c = *ptr;
-    
-    /* Non-alphamerics are literals. For digits or letters, do an initial lookup in
-     a table. A non-zero result is something that can be returned immediately.
-     Otherwise further processing may be required. */
-    
-    if (c < '0' || c > 'z') { /* Not alphameric */
-    } else if (int escapeValue = escapes[c - '0']) {
-        c = escapeValue;
-        if (isClass) {
-            if (-c == ESC_b)
-                c = '\b'; /* \b is backslash in a class */
-            else if (-c == ESC_B)
-                c = 'B'; /* and \B is a capital B in a class (in browsers event though ECMAScript 15.10.2.19 says it raises an error) */
-        }
-    /* Escapes that need further processing, or are illegal. */
-    
-    } else {
-        switch (c) {
-            case '1':
-            case '2':
-            case '3':
-            case '4':
-            case '5':
-            case '6':
-            case '7':
-            case '8':
-            case '9':
-                /* Escape sequences starting with a non-zero digit are backreferences,
-                 unless there are insufficient brackets, in which case they are octal
-                 escape sequences. Those sequences end on the first non-octal character
-                 or when we overflow 0-255, whichever comes first. */
-                
-                if (!isClass) {
-                    const UChar* oldptr = ptr;
-                    c -= '0';
-                    while ((ptr + 1 < patternEnd) && isASCIIDigit(ptr[1]) && c <= bracount)
-                        c = c * 10 + *(++ptr) - '0';
-                    if (c <= bracount) {
-                        c = -(ESC_REF + c);
-                        break;
-                    }
-                    ptr = oldptr;      /* Put the pointer back and fall through */
-                }
-                
-                /* Handle an octal number following \. If the first digit is 8 or 9,
-                 this is not octal. */
-                
-                if ((c = *ptr) >= '8') {
-                    c = '\\';
-                    ptr -= 1;
-                    break;
-                }
-
-            /* \0 always starts an octal number, but we may drop through to here with a
-             larger first octal digit. */
-
-            case '0': {
-                c -= '0';
-                int i;
-                for (i = 1; i <= 2; ++i) {
-                    if (ptr + i >= patternEnd || ptr[i] < '0' || ptr[i] > '7')
-                        break;
-                    int cc = c * 8 + ptr[i] - '0';
-                    if (cc > 255)
-                        break;
-                    c = cc;
-                }
-                ptr += i - 1;
-                break;
-            }
-
-            case 'x': {
-                c = 0;
-                int i;
-                for (i = 1; i <= 2; ++i) {
-                    if (ptr + i >= patternEnd || !isASCIIHexDigit(ptr[i])) {
-                        c = 'x';
-                        i = 1;
-                        break;
-                    }
-                    int cc = ptr[i];
-                    if (cc >= 'a')
-                        cc -= 32;             /* Convert to upper case */
-                    c = c * 16 + cc - ((cc < 'A') ? '0' : ('A' - 10));
-                }
-                ptr += i - 1;
-                break;
-            }
-
-            case 'u': {
-                c = 0;
-                int i;
-                for (i = 1; i <= 4; ++i) {
-                    if (ptr + i >= patternEnd || !isASCIIHexDigit(ptr[i])) {
-                        c = 'u';
-                        i = 1;
-                        break;
-                    }
-                    int cc = ptr[i];
-                    if (cc >= 'a')
-                        cc -= 32;             /* Convert to upper case */
-                    c = c * 16 + cc - ((cc < 'A') ? '0' : ('A' - 10));
-                }
-                ptr += i - 1;
-                break;
-            }
-
-            case 'c':
-                if (++ptr == patternEnd) {
-                    *errorCodePtr = ERR2;
-                    return 0;
-                }
-                
-                c = *ptr;
-
-                /* To match Firefox, inside a character class, we also accept
-                   numbers and '_' as control characters */
-                if ((!isClass && !isASCIIAlpha(c)) || (!isASCIIAlphanumeric(c) && c != '_')) {
-                    c = '\\';
-                    ptr -= 2;
-                    break;
-                }
-
-                /* A letter is upper-cased; then the 0x40 bit is flipped. This coding
-                 is ASCII-specific, but then the whole concept of \cx is ASCII-specific. */
-                c = toASCIIUpper(c) ^ 0x40;
-                break;
-            }
-    }
-    
-    *ptrPtr = ptr;
-    return c;
-}
-
-/*************************************************
-*            Check for counted repeat            *
-*************************************************/
-
-/* This function is called when a '{' is encountered in a place where it might
-start a quantifier. It looks ahead to see if it really is a quantifier or not.
-It is only a quantifier if it is one of the forms {ddd} {ddd,} or {ddd,ddd}
-where the ddds are digits.
-
-Arguments:
-  p         pointer to the first char after '{'
-
-Returns:    true or false
-*/
-
-static bool isCountedRepeat(const UChar* p, const UChar* patternEnd)
-{
-    if (p >= patternEnd || !isASCIIDigit(*p))
-        return false;
-    p++;
-    while (p < patternEnd && isASCIIDigit(*p))
-        p++;
-    if (p < patternEnd && *p == '}')
-        return true;
-    
-    if (p >= patternEnd || *p++ != ',')
-        return false;
-    if (p < patternEnd && *p == '}')
-        return true;
-    
-    if (p >= patternEnd || !isASCIIDigit(*p))
-        return false;
-    p++;
-    while (p < patternEnd && isASCIIDigit(*p))
-        p++;
-    
-    return (p < patternEnd && *p == '}');
-}
-
-/*************************************************
-*         Read repeat counts                     *
-*************************************************/
-
-/* Read an item of the form {n,m} and return the values. This is called only
-after isCountedRepeat() has confirmed that a repeat-count quantifier exists,
-so the syntax is guaranteed to be correct, but we need to check the values.
-
-Arguments:
-  p              pointer to first char after '{'
-  minp           pointer to int for min
-  maxp           pointer to int for max
-                 returned as -1 if no max
-  errorCodePtr   points to error code variable
-
-Returns:         pointer to '}' on success;
-                 current ptr on error, with errorCodePtr set non-zero
-*/
-
-static const UChar* readRepeatCounts(const UChar* p, int* minp, int* maxp, ErrorCode* errorCodePtr)
-{
-    int min = 0;
-    int max = -1;
-    
-    /* Read the minimum value and do a paranoid check: a negative value indicates
-     an integer overflow. */
-    
-    while (isASCIIDigit(*p))
-        min = min * 10 + *p++ - '0';
-    if (min < 0 || min > 65535) {
-        *errorCodePtr = ERR5;
-        return p;
-    }
-    
-    /* Read the maximum value if there is one, and again do a paranoid on its size.
-     Also, max must not be less than min. */
-    
-    if (*p == '}')
-        max = min;
-    else {
-        if (*(++p) != '}') {
-            max = 0;
-            while (isASCIIDigit(*p))
-                max = max * 10 + *p++ - '0';
-            if (max < 0 || max > 65535) {
-                *errorCodePtr = ERR5;
-                return p;
-            }
-            if (max < min) {
-                *errorCodePtr = ERR4;
-                return p;
-            }
-        }
-    }
-    
-    /* Fill in the required variables, and pass back the pointer to the terminating
-     '}'. */
-    
-    *minp = min;
-    *maxp = max;
-    return p;
-}
-
-/*************************************************
-*      Find first significant op code            *
-*************************************************/
-
-/* This is called by several functions that scan a compiled expression looking
-for a fixed first character, or an anchoring op code etc. It skips over things
-that do not influence this.
-
-Arguments:
-  code         pointer to the start of the group
-Returns:       pointer to the first significant opcode
-*/
-
-static const unsigned char* firstSignificantOpcode(const unsigned char* code)
-{
-    while (*code == OP_BRANUMBER)
-        code += 3;
-    return code;
-}
-
-static const unsigned char* firstSignificantOpcodeSkippingAssertions(const unsigned char* code)
-{
-    while (true) {
-        switch (*code) {
-            case OP_ASSERT_NOT:
-                advanceToEndOfBracket(code);
-                code += 1 + LINK_SIZE;
-                break;
-            case OP_WORD_BOUNDARY:
-            case OP_NOT_WORD_BOUNDARY:
-                ++code;
-                break;
-            case OP_BRANUMBER:
-                code += 3;
-                break;
-            default:
-                return code;
-        }
-    }
-}
-
-/*************************************************
-*           Get othercase range                  *
-*************************************************/
-
-/* This function is passed the start and end of a class range, in UTF-8 mode
-with UCP support. It searches up the characters, looking for internal ranges of
-characters in the "other" case. Each call returns the next one, updating the
-start address.
-
-Arguments:
-  cptr        points to starting character value; updated
-  d           end value
-  ocptr       where to put start of othercase range
-  odptr       where to put end of othercase range
-
-Yield:        true when range returned; false when no more
-*/
-
-static bool getOthercaseRange(int* cptr, int d, int* ocptr, int* odptr)
-{
-    int c, othercase = 0;
-    
-    for (c = *cptr; c <= d; c++) {
-        if ((othercase = jsc_pcre_ucp_othercase(c)) >= 0)
-            break;
-    }
-    
-    if (c > d)
-        return false;
-    
-    *ocptr = othercase;
-    int next = othercase + 1;
-    
-    for (++c; c <= d; c++) {
-        if (jsc_pcre_ucp_othercase(c) != next)
-            break;
-        next++;
-    }
-    
-    *odptr = next - 1;
-    *cptr = c;
-    
-    return true;
-}
-
-/*************************************************
- *       Convert character value to UTF-8         *
- *************************************************/
-
-/* This function takes an integer value in the range 0 - 0x7fffffff
- and encodes it as a UTF-8 character in 0 to 6 bytes.
- 
- Arguments:
- cvalue     the character value
- buffer     pointer to buffer for result - at least 6 bytes long
- 
- Returns:     number of characters placed in the buffer
- */
-
-static int encodeUTF8(int cvalue, unsigned char *buffer)
-{
-    int i;
-    for (i = 0; i < jsc_pcre_utf8_table1_size; i++)
-        if (cvalue <= jsc_pcre_utf8_table1[i])
-            break;
-    buffer += i;
-    for (int j = i; j > 0; j--) {
-        *buffer-- = 0x80 | (cvalue & 0x3f);
-        cvalue >>= 6;
-    }
-    *buffer = jsc_pcre_utf8_table2[i] | cvalue;
-    return i + 1;
-}
-
-/*************************************************
-*           Compile one branch                   *
-*************************************************/
-
-/* Scan the pattern, compiling it into the code vector.
-
-Arguments:
-  options        the option bits
-  brackets       points to number of extracting brackets used
-  codePtr        points to the pointer to the current code point
-  ptrPtr         points to the current pattern pointer
-  errorCodePtr   points to error code variable
-  firstbyteptr   set to initial literal character, or < 0 (REQ_UNSET, REQ_NONE)
-  reqbyteptr     set to the last literal character required, else < 0
-  cd             contains pointers to tables etc.
-
-Returns:         true on success
-                 false, with *errorCodePtr set non-zero on error
-*/
-
-static inline bool safelyCheckNextChar(const UChar* ptr, const UChar* patternEnd, UChar expected)
-{
-    return ((ptr + 1 < patternEnd) && ptr[1] == expected);
-}
-
-static bool
-compileBranch(int options, int* brackets, unsigned char** codePtr,
-               const UChar** ptrPtr, const UChar* patternEnd, ErrorCode* errorCodePtr, int *firstbyteptr,
-               int* reqbyteptr, CompileData& cd)
-{
-    int repeatType, opType;
-    int repeatMin = 0, repeat_max = 0;      /* To please picky compilers */
-    int bravalue = 0;
-    int reqvary, tempreqvary;
-    int c;
-    unsigned char* code = *codePtr;
-    unsigned char* tempcode;
-    bool didGroupSetFirstByte = false;
-    const UChar* ptr = *ptrPtr;
-    const UChar* tempptr;
-    unsigned char* previous = NULL;
-    unsigned char classbits[32];
-    
-    bool class_utf8;
-    unsigned char* class_utf8data;
-    unsigned char utf8_char[6];
-    
-    /* Initialize no first byte, no required byte. REQ_UNSET means "no char
-     matching encountered yet". It gets changed to REQ_NONE if we hit something that
-     matches a non-fixed char first char; reqByte just remains unset if we never
-     find one.
-     
-     When we hit a repeat whose minimum is zero, we may have to adjust these values
-     to take the zero repeat into account. This is implemented by setting them to
-     zeroFirstByte and zeroReqByte when such a repeat is encountered. The individual
-     item types that can be repeated set these backoff variables appropriately. */
-    
-    int firstByte = REQ_UNSET;
-    int reqByte = REQ_UNSET;
-    int zeroReqByte = REQ_UNSET;
-    int zeroFirstByte = REQ_UNSET;
-    
-    /* The variable reqCaseOpt contains either the REQ_IGNORE_CASE value or zero,
-     according to the current setting of the ignores-case flag. REQ_IGNORE_CASE is a bit
-     value > 255. It is added into the firstByte or reqByte variables to record the
-     case status of the value. This is used only for ASCII characters. */
-    
-    int reqCaseOpt = (options & IgnoreCaseOption) ? REQ_IGNORE_CASE : 0;
-    
-    /* Switch on next character until the end of the branch */
-    
-    for (;; ptr++) {
-        bool negateClass;
-        bool shouldFlipNegation; /* If a negative special such as \S is used, we should negate the whole class to properly support Unicode. */
-        int classCharCount;
-        int classLastChar;
-        int skipBytes;
-        int subReqByte;
-        int subFirstByte;
-        int mcLength;
-        unsigned char mcbuffer[8];
-        
-        /* Next byte in the pattern */
-        
-        c = ptr < patternEnd ? *ptr : 0;
-        
-        /* Fill in length of a previous callout, except when the next thing is
-         a quantifier. */
-        
-        bool isQuantifier = c == '*' || c == '+' || c == '?' || (c == '{' && isCountedRepeat(ptr + 1, patternEnd));
-        
-        switch (c) {
-            /* The branch terminates at end of string, |, or ). */
-                
-            case 0:
-                if (ptr < patternEnd)
-                    goto NORMAL_CHAR;
-                // End of string; fall through
-            case '|':
-            case ')':
-                *firstbyteptr = firstByte;
-                *reqbyteptr = reqByte;
-                *codePtr = code;
-                *ptrPtr = ptr;
-                return true;
-                
-            /* Handle single-character metacharacters. In multiline mode, ^ disables
-             the setting of any following char as a first character. */
-
-            case '^':
-                if (options & MatchAcrossMultipleLinesOption) {
-                    if (firstByte == REQ_UNSET)
-                        firstByte = REQ_NONE;
-                    *code++ = OP_BOL;
-                } else
-                    *code++ = OP_CIRC;
-                previous = NULL;
-                break;
-
-            case '$':
-                previous = NULL;
-                if (options & MatchAcrossMultipleLinesOption)
-                  *code++ = OP_EOL;
-                else
-                  *code++ = OP_DOLL;
-                break;
-
-            /* There can never be a first char if '.' is first, whatever happens about
-             repeats. The value of reqByte doesn't change either. */
-
-            case '.':
-                if (firstByte == REQ_UNSET)
-                    firstByte = REQ_NONE;
-                zeroFirstByte = firstByte;
-                zeroReqByte = reqByte;
-                previous = code;
-                *code++ = OP_NOT_NEWLINE;
-                break;
-                
-            /* Character classes. If the included characters are all < 256, we build a
-             32-byte bitmap of the permitted characters, except in the special case
-             where there is only one such character. For negated classes, we build the
-             map as usual, then invert it at the end. However, we use a different opcode
-             so that data characters > 255 can be handled correctly.
-             
-             If the class contains characters outside the 0-255 range, a different
-             opcode is compiled. It may optionally have a bit map for characters < 256,
-             but those above are are explicitly listed afterwards. A flag byte tells
-             whether the bitmap is present, and whether this is a negated class or not.
-             */
-                
-            case '[': {
-                previous = code;
-                shouldFlipNegation = false;
-                
-                /* PCRE supports POSIX class stuff inside a class. Perl gives an error if
-                 they are encountered at the top level, so we'll do that too. */
-                
-                /* If the first character is '^', set the negation flag and skip it. */
-
-                if (ptr + 1 >= patternEnd) {
-                    *errorCodePtr = ERR6;
-                    return false;
-                }
-
-                if (ptr[1] == '^') {
-                    negateClass = true;
-                    ++ptr;
-                } else
-                    negateClass = false;
-                
-                /* Keep a count of chars with values < 256 so that we can optimize the case
-                 of just a single character (as long as it's < 256). For higher valued UTF-8
-                 characters, we don't yet do any optimization. */
-                
-                classCharCount = 0;
-                classLastChar = -1;
-                
-                class_utf8 = false;                       /* No chars >= 256 */
-                class_utf8data = code + LINK_SIZE + 34;   /* For UTF-8 items */
-                
-                /* Initialize the 32-char bit map to all zeros. We have to build the
-                 map in a temporary bit of store, in case the class contains only 1
-                 character (< 256), because in that case the compiled code doesn't use the
-                 bit map. */
-                
-                memset(classbits, 0, 32 * sizeof(unsigned char));
-                
-                /* Process characters until ] is reached. The first pass
-                 through the regex checked the overall syntax, so we don't need to be very
-                 strict here. At the start of the loop, c contains the first byte of the
-                 character. */
-
-                while ((++ptr < patternEnd) && (c = *ptr) != ']') {
-                    /* Backslash may introduce a single character, or it may introduce one
-                     of the specials, which just set a flag. Escaped items are checked for
-                     validity in the pre-compiling pass. The sequence \b is a special case.
-                     Inside a class (and only there) it is treated as backspace. Elsewhere
-                     it marks a word boundary. Other escapes have preset maps ready to
-                     or into the one we are building. We assume they have more than one
-                     character in them, so set classCharCount bigger than one. */
-                    
-                    if (c == '\\') {
-                        c = checkEscape(&ptr, patternEnd, errorCodePtr, cd.numCapturingBrackets, true);
-                        if (c < 0) {
-                            classCharCount += 2;     /* Greater than 1 is what matters */
-                            switch (-c) {
-                                case ESC_d:
-                                    for (c = 0; c < 32; c++)
-                                        classbits[c] |= classBitmapForChar(c + cbit_digit);
-                                    continue;
-                                    
-                                case ESC_D:
-                                    shouldFlipNegation = true;
-                                    for (c = 0; c < 32; c++)
-                                        classbits[c] |= ~classBitmapForChar(c + cbit_digit);
-                                    continue;
-                                    
-                                case ESC_w:
-                                    for (c = 0; c < 32; c++)
-                                        classbits[c] |= classBitmapForChar(c + cbit_word);
-                                    continue;
-                                    
-                                case ESC_W:
-                                    shouldFlipNegation = true;
-                                    for (c = 0; c < 32; c++)
-                                        classbits[c] |= ~classBitmapForChar(c + cbit_word);
-                                    continue;
-                                    
-                                case ESC_s:
-                                    for (c = 0; c < 32; c++)
-                                         classbits[c] |= classBitmapForChar(c + cbit_space);
-                                    continue;
-                                    
-                                case ESC_S:
-                                    shouldFlipNegation = true;
-                                    for (c = 0; c < 32; c++)
-                                         classbits[c] |= ~classBitmapForChar(c + cbit_space);
-                                    continue;
-                                    
-                                    /* Unrecognized escapes are faulted if PCRE is running in its
-                                     strict mode. By default, for compatibility with Perl, they are
-                                     treated as literals. */
-                                    
-                                default:
-                                    c = *ptr;              /* The final character */
-                                    classCharCount -= 2;  /* Undo the default count from above */
-                            }
-                        }
-                        
-                        /* Fall through if we have a single character (c >= 0). This may be
-                         > 256 in UTF-8 mode. */
-                        
-                    }   /* End of backslash handling */
-                    
-                    /* A single character may be followed by '-' to form a range. However,
-                     Perl does not permit ']' to be the end of the range. A '-' character
-                     here is treated as a literal. */
-                    
-                    if ((ptr + 2 < patternEnd) && ptr[1] == '-' && ptr[2] != ']') {
-                        ptr += 2;
-                        
-                        int d = *ptr;
-                        
-                        /* The second part of a range can be a single-character escape, but
-                         not any of the other escapes. Perl 5.6 treats a hyphen as a literal
-                         in such circumstances. */
-                        
-                        if (d == '\\') {
-                            const UChar* oldptr = ptr;
-                            d = checkEscape(&ptr, patternEnd, errorCodePtr, cd.numCapturingBrackets, true);
-                            
-                            /* \X is literal X; any other special means the '-' was literal */
-                            if (d < 0) {
-                                ptr = oldptr - 2;
-                                goto LONE_SINGLE_CHARACTER;  /* A few lines below */
-                            }
-                        }
-                        
-                        /* The check that the two values are in the correct order happens in
-                         the pre-pass. Optimize one-character ranges */
-                        
-                        if (d == c)
-                            goto LONE_SINGLE_CHARACTER;  /* A few lines below */
-                        
-                        /* In UTF-8 mode, if the upper limit is > 255, or > 127 for caseless
-                         matching, we have to use an XCLASS with extra data items. Caseless
-                         matching for characters > 127 is available only if UCP support is
-                         available. */
-                        
-                        if ((d > 255 || ((options & IgnoreCaseOption) && d > 127))) {
-                            class_utf8 = true;
-                            
-                            /* With UCP support, we can find the other case equivalents of
-                             the relevant characters. There may be several ranges. Optimize how
-                             they fit with the basic range. */
-                            
-                            if (options & IgnoreCaseOption) {
-                                int occ, ocd;
-                                int cc = c;
-                                int origd = d;
-                                while (getOthercaseRange(&cc, origd, &occ, &ocd)) {
-                                    if (occ >= c && ocd <= d)
-                                        continue;  /* Skip embedded ranges */
-                                    
-                                    if (occ < c  && ocd >= c - 1)        /* Extend the basic range */
-                                    {                                  /* if there is overlap,   */
-                                        c = occ;                           /* noting that if occ < c */
-                                        continue;                          /* we can't have ocd > d  */
-                                    }                                  /* because a subrange is  */
-                                    if (ocd > d && occ <= d + 1)         /* always shorter than    */
-                                    {                                  /* the basic range.       */
-                                        d = ocd;
-                                        continue;
-                                    }
-                                    
-                                    if (occ == ocd)
-                                        *class_utf8data++ = XCL_SINGLE;
-                                    else {
-                                        *class_utf8data++ = XCL_RANGE;
-                                        class_utf8data += encodeUTF8(occ, class_utf8data);
-                                    }
-                                    class_utf8data += encodeUTF8(ocd, class_utf8data);
-                                }
-                            }
-                            
-                            /* Now record the original range, possibly modified for UCP caseless
-                             overlapping ranges. */
-                            
-                            *class_utf8data++ = XCL_RANGE;
-                            class_utf8data += encodeUTF8(c, class_utf8data);
-                            class_utf8data += encodeUTF8(d, class_utf8data);
-                            
-                            /* With UCP support, we are done. Without UCP support, there is no
-                             caseless matching for UTF-8 characters > 127; we can use the bit map
-                             for the smaller ones. */
-                            
-                            continue;    /* With next character in the class */
-                        }
-                        
-                        /* We use the bit map for all cases when not in UTF-8 mode; else
-                         ranges that lie entirely within 0-127 when there is UCP support; else
-                         for partial ranges without UCP support. */
-                        
-                        for (; c <= d; c++) {
-                            classbits[c/8] |= (1 << (c&7));
-                            if (options & IgnoreCaseOption) {
-                                int uc = flipCase(c);
-                                classbits[uc/8] |= (1 << (uc&7));
-                            }
-                            classCharCount++;                /* in case a one-char range */
-                            classLastChar = c;
-                        }
-                        
-                        continue;   /* Go get the next char in the class */
-                    }
-                    
-                    /* Handle a lone single character - we can get here for a normal
-                     non-escape char, or after \ that introduces a single character or for an
-                     apparent range that isn't. */
-                    
-                LONE_SINGLE_CHARACTER:
-                    
-                    /* Handle a character that cannot go in the bit map */
-                    
-                    if ((c > 255 || ((options & IgnoreCaseOption) && c > 127))) {
-                        class_utf8 = true;
-                        *class_utf8data++ = XCL_SINGLE;
-                        class_utf8data += encodeUTF8(c, class_utf8data);
-                        
-                        if (options & IgnoreCaseOption) {
-                            int othercase;
-                            if ((othercase = jsc_pcre_ucp_othercase(c)) >= 0) {
-                                *class_utf8data++ = XCL_SINGLE;
-                                class_utf8data += encodeUTF8(othercase, class_utf8data);
-                            }
-                        }
-                    } else {
-                        /* Handle a single-byte character */
-                        classbits[c/8] |= (1 << (c&7));
-                        if (options & IgnoreCaseOption) {
-                            c = flipCase(c);
-                            classbits[c/8] |= (1 << (c&7));
-                        }
-                        classCharCount++;
-                        classLastChar = c;
-                    }
-                }
-                
-                /* If classCharCount is 1, we saw precisely one character whose value is
-                 less than 256. In non-UTF-8 mode we can always optimize. In UTF-8 mode, we
-                 can optimize the negative case only if there were no characters >= 128
-                 because OP_NOT and the related opcodes like OP_NOTSTAR operate on
-                 single-bytes only. This is an historical hangover. Maybe one day we can
-                 tidy these opcodes to handle multi-byte characters.
-                 
-                 The optimization throws away the bit map. We turn the item into a
-                 1-character OP_CHAR[NC] if it's positive, or OP_NOT if it's negative. Note
-                 that OP_NOT does not support multibyte characters. In the positive case, it
-                 can cause firstByte to be set. Otherwise, there can be no first char if
-                 this item is first, whatever repeat count may follow. In the case of
-                 reqByte, save the previous value for reinstating. */
-                
-                if (classCharCount == 1 && (!class_utf8 && (!negateClass || classLastChar < 128))) {
-                    zeroReqByte = reqByte;
-                    
-                    /* The OP_NOT opcode works on one-byte characters only. */
-                    
-                    if (negateClass) {
-                        if (firstByte == REQ_UNSET)
-                            firstByte = REQ_NONE;
-                        zeroFirstByte = firstByte;
-                        *code++ = OP_NOT;
-                        *code++ = classLastChar;
-                        break;
-                    }
-                    
-                    /* For a single, positive character, get the value into c, and
-                     then we can handle this with the normal one-character code. */
-                    
-                    c = classLastChar;
-                    goto NORMAL_CHAR;
-                }       /* End of 1-char optimization */
-                
-                /* The general case - not the one-char optimization. If this is the first
-                 thing in the branch, there can be no first char setting, whatever the
-                 repeat count. Any reqByte setting must remain unchanged after any kind of
-                 repeat. */
-                
-                if (firstByte == REQ_UNSET) firstByte = REQ_NONE;
-                zeroFirstByte = firstByte;
-                zeroReqByte = reqByte;
-                
-                /* If there are characters with values > 255, we have to compile an
-                 extended class, with its own opcode. If there are no characters < 256,
-                 we can omit the bitmap. */
-                
-                if (class_utf8 && !shouldFlipNegation) {
-                    *class_utf8data++ = XCL_END;    /* Marks the end of extra data */
-                    *code++ = OP_XCLASS;
-                    code += LINK_SIZE;
-                    *code = negateClass? XCL_NOT : 0;
-                    
-                    /* If the map is required, install it, and move on to the end of
-                     the extra data */
-                    
-                    if (classCharCount > 0) {
-                        *code++ |= XCL_MAP;
-                        memcpy(code, classbits, 32);
-                        code = class_utf8data;
-                    }
-                    
-                    /* If the map is not required, slide down the extra data. */
-                    
-                    else {
-                        int len = class_utf8data - (code + 33);
-                        memmove(code + 1, code + 33, len);
-                        code += len + 1;
-                    }
-                    
-                    /* Now fill in the complete length of the item */
-                    
-                    putLinkValue(previous + 1, code - previous);
-                    break;   /* End of class handling */
-                }
-                
-                /* If there are no characters > 255, negate the 32-byte map if necessary,
-                 and copy it into the code vector. If this is the first thing in the branch,
-                 there can be no first char setting, whatever the repeat count. Any reqByte
-                 setting must remain unchanged after any kind of repeat. */
-                
-                *code++ = (negateClass == shouldFlipNegation) ? OP_CLASS : OP_NCLASS;
-                if (negateClass)
-                    for (c = 0; c < 32; c++)
-                        code[c] = ~classbits[c];
-                else
-                    memcpy(code, classbits, 32);
-                code += 32;
-                break;
-            }
-                
-            /* Various kinds of repeat; '{' is not necessarily a quantifier, but this
-             has been tested above. */
-
-            case '{':
-                if (!isQuantifier)
-                    goto NORMAL_CHAR;
-                ptr = readRepeatCounts(ptr + 1, &repeatMin, &repeat_max, errorCodePtr);
-                if (*errorCodePtr)
-                    goto FAILED;
-                goto REPEAT;
-                
-            case '*':
-                repeatMin = 0;
-                repeat_max = -1;
-                goto REPEAT;
-                
-            case '+':
-                repeatMin = 1;
-                repeat_max = -1;
-                goto REPEAT;
-                
-            case '?':
-                repeatMin = 0;
-                repeat_max = 1;
-                
-            REPEAT:
-                if (!previous) {
-                    *errorCodePtr = ERR9;
-                    goto FAILED;
-                }
-                
-                if (repeatMin == 0) {
-                    firstByte = zeroFirstByte;    /* Adjust for zero repeat */
-                    reqByte = zeroReqByte;        /* Ditto */
-                }
-                
-                /* Remember whether this is a variable length repeat */
-                
-                reqvary = (repeatMin == repeat_max) ? 0 : REQ_VARY;
-                
-                opType = 0;                    /* Default single-char op codes */
-                
-                /* Save start of previous item, in case we have to move it up to make space
-                 for an inserted OP_ONCE for the additional '+' extension. */
-                /* FIXME: Probably don't need this because we don't use OP_ONCE. */
-                
-                tempcode = previous;
-                
-                /* If the next character is '+', we have a possessive quantifier. This
-                 implies greediness, whatever the setting of the PCRE_UNGREEDY option.
-                 If the next character is '?' this is a minimizing repeat, by default,
-                 but if PCRE_UNGREEDY is set, it works the other way round. We change the
-                 repeat type to the non-default. */
-                
-                if (safelyCheckNextChar(ptr, patternEnd, '?')) {
-                    repeatType = 1;
-                    ptr++;
-                } else
-                    repeatType = 0;
-                
-                /* If previous was a character match, abolish the item and generate a
-                 repeat item instead. If a char item has a minumum of more than one, ensure
-                 that it is set in reqByte - it might not be if a sequence such as x{3} is
-                 the first thing in a branch because the x will have gone into firstByte
-                 instead.  */
-                
-                if (*previous == OP_CHAR || *previous == OP_CHAR_IGNORING_CASE) {
-                    /* Deal with UTF-8 characters that take up more than one byte. It's
-                     easier to write this out separately than try to macrify it. Use c to
-                     hold the length of the character in bytes, plus 0x80 to flag that it's a
-                     length rather than a small character. */
-                    
-                    if (code[-1] & 0x80) {
-                        unsigned char *lastchar = code - 1;
-                        while((*lastchar & 0xc0) == 0x80)
-                            lastchar--;
-                        c = code - lastchar;            /* Length of UTF-8 character */
-                        memcpy(utf8_char, lastchar, c); /* Save the char */
-                        c |= 0x80;                      /* Flag c as a length */
-                    }
-                    else {
-                        c = code[-1];
-                        if (repeatMin > 1)
-                            reqByte = c | reqCaseOpt | cd.reqVaryOpt;
-                    }
-                    
-                    goto OUTPUT_SINGLE_REPEAT;   /* Code shared with single character types */
-                }
-                
-                else if (*previous == OP_ASCII_CHAR || *previous == OP_ASCII_LETTER_IGNORING_CASE) {
-                    c = previous[1];
-                    if (repeatMin > 1)
-                        reqByte = c | reqCaseOpt | cd.reqVaryOpt;
-                    goto OUTPUT_SINGLE_REPEAT;
-                }
-                
-                /* If previous was a single negated character ([^a] or similar), we use
-                 one of the special opcodes, replacing it. The code is shared with single-
-                 character repeats by setting opt_type to add a suitable offset into
-                 repeatType. OP_NOT is currently used only for single-byte chars. */
-                
-                else if (*previous == OP_NOT) {
-                    opType = OP_NOTSTAR - OP_STAR;  /* Use "not" opcodes */
-                    c = previous[1];
-                    goto OUTPUT_SINGLE_REPEAT;
-                }
-                
-                /* If previous was a character type match (\d or similar), abolish it and
-                 create a suitable repeat item. The code is shared with single-character
-                 repeats by setting opType to add a suitable offset into repeatType. */
-                
-                else if (*previous <= OP_NOT_NEWLINE) {
-                    opType = OP_TYPESTAR - OP_STAR;  /* Use type opcodes */
-                    c = *previous;
-                    
-                OUTPUT_SINGLE_REPEAT:
-                    int prop_type = -1;
-                    int prop_value = -1;
-                    
-                    unsigned char* oldcode = code;
-                    code = previous;                  /* Usually overwrite previous item */
-                    
-                    /* If the maximum is zero then the minimum must also be zero; Perl allows
-                     this case, so we do too - by simply omitting the item altogether. */
-                    
-                    if (repeat_max == 0)
-                        goto END_REPEAT;
-                    
-                    /* Combine the opType with the repeatType */
-                    
-                    repeatType += opType;
-                    
-                    /* A minimum of zero is handled either as the special case * or ?, or as
-                     an UPTO, with the maximum given. */
-                    
-                    if (repeatMin == 0) {
-                        if (repeat_max == -1)
-                            *code++ = OP_STAR + repeatType;
-                        else if (repeat_max == 1)
-                            *code++ = OP_QUERY + repeatType;
-                        else {
-                            *code++ = OP_UPTO + repeatType;
-                            put2ByteValueAndAdvance(code, repeat_max);
-                        }
-                    }
-                    
-                    /* A repeat minimum of 1 is optimized into some special cases. If the
-                     maximum is unlimited, we use OP_PLUS. Otherwise, the original item it
-                     left in place and, if the maximum is greater than 1, we use OP_UPTO with
-                     one less than the maximum. */
-                    
-                    else if (repeatMin == 1) {
-                        if (repeat_max == -1)
-                            *code++ = OP_PLUS + repeatType;
-                        else {
-                            code = oldcode;                 /* leave previous item in place */
-                            if (repeat_max == 1)
-                                goto END_REPEAT;
-                            *code++ = OP_UPTO + repeatType;
-                            put2ByteValueAndAdvance(code, repeat_max - 1);
-                        }
-                    }
-                    
-                    /* The case {n,n} is just an EXACT, while the general case {n,m} is
-                     handled as an EXACT followed by an UPTO. */
-                    
-                    else {
-                        *code++ = OP_EXACT + opType;  /* NB EXACT doesn't have repeatType */
-                        put2ByteValueAndAdvance(code, repeatMin);
-                        
-                        /* If the maximum is unlimited, insert an OP_STAR. Before doing so,
-                         we have to insert the character for the previous code. For a repeated
-                         Unicode property match, there are two extra bytes that define the
-                         required property. In UTF-8 mode, long characters have their length in
-                         c, with the 0x80 bit as a flag. */
-                        
-                        if (repeat_max < 0) {
-                            if (c >= 128) {
-                                memcpy(code, utf8_char, c & 7);
-                                code += c & 7;
-                            } else {
-                                *code++ = c;
-                                if (prop_type >= 0) {
-                                    *code++ = prop_type;
-                                    *code++ = prop_value;
-                                }
-                            }
-                            *code++ = OP_STAR + repeatType;
-                        }
-                        
-                        /* Else insert an UPTO if the max is greater than the min, again
-                         preceded by the character, for the previously inserted code. */
-                        
-                        else if (repeat_max != repeatMin) {
-                            if (c >= 128) {
-                                memcpy(code, utf8_char, c & 7);
-                                code += c & 7;
-                            } else
-                                *code++ = c;
-                            if (prop_type >= 0) {
-                                *code++ = prop_type;
-                                *code++ = prop_value;
-                            }
-                            repeat_max -= repeatMin;
-                            *code++ = OP_UPTO + repeatType;
-                            put2ByteValueAndAdvance(code, repeat_max);
-                        }
-                    }
-                    
-                    /* The character or character type itself comes last in all cases. */
-                    
-                    if (c >= 128) {
-                        memcpy(code, utf8_char, c & 7);
-                        code += c & 7;
-                    } else
-                        *code++ = c;
-                    
-                    /* For a repeated Unicode property match, there are two extra bytes that
-                     define the required property. */
-                    
-                    if (prop_type >= 0) {
-                        *code++ = prop_type;
-                        *code++ = prop_value;
-                    }
-                }
-                
-                /* If previous was a character class or a back reference, we put the repeat
-                 stuff after it, but just skip the item if the repeat was {0,0}. */
-                
-                else if (*previous == OP_CLASS ||
-                         *previous == OP_NCLASS ||
-                         *previous == OP_XCLASS ||
-                         *previous == OP_REF)
-                {
-                    if (repeat_max == 0) {
-                        code = previous;
-                        goto END_REPEAT;
-                    }
-                    
-                    if (repeatMin == 0 && repeat_max == -1)
-                        *code++ = OP_CRSTAR + repeatType;
-                    else if (repeatMin == 1 && repeat_max == -1)
-                        *code++ = OP_CRPLUS + repeatType;
-                    else if (repeatMin == 0 && repeat_max == 1)
-                        *code++ = OP_CRQUERY + repeatType;
-                    else {
-                        *code++ = OP_CRRANGE + repeatType;
-                        put2ByteValueAndAdvance(code, repeatMin);
-                        if (repeat_max == -1)
-                            repeat_max = 0;  /* 2-byte encoding for max */
-                        put2ByteValueAndAdvance(code, repeat_max);
-                    }
-                }
-                
-                /* If previous was a bracket group, we may have to replicate it in certain
-                 cases. */
-                
-                else if (*previous >= OP_BRA) {
-                    int ketoffset = 0;
-                    int len = code - previous;
-                    unsigned char* bralink = NULL;
-                    
-                    /* If the maximum repeat count is unlimited, find the end of the bracket
-                     by scanning through from the start, and compute the offset back to it
-                     from the current code pointer. There may be an OP_OPT setting following
-                     the final KET, so we can't find the end just by going back from the code
-                     pointer. */
-                    
-                    if (repeat_max == -1) {
-                        const unsigned char* ket = previous;
-                        advanceToEndOfBracket(ket);
-                        ketoffset = code - ket;
-                    }
-                    
-                    /* The case of a zero minimum is special because of the need to stick
-                     OP_BRAZERO in front of it, and because the group appears once in the
-                     data, whereas in other cases it appears the minimum number of times. For
-                     this reason, it is simplest to treat this case separately, as otherwise
-                     the code gets far too messy. There are several special subcases when the
-                     minimum is zero. */
-                    
-                    if (repeatMin == 0) {
-                        /* If the maximum is also zero, we just omit the group from the output
-                         altogether. */
-                        
-                        if (repeat_max == 0) {
-                            code = previous;
-                            goto END_REPEAT;
-                        }
-                        
-                        /* If the maximum is 1 or unlimited, we just have to stick in the
-                         BRAZERO and do no more at this point. However, we do need to adjust
-                         any OP_RECURSE calls inside the group that refer to the group itself or
-                         any internal group, because the offset is from the start of the whole
-                         regex. Temporarily terminate the pattern while doing this. */
-                        
-                        if (repeat_max <= 1) {
-                            *code = OP_END;
-                            memmove(previous+1, previous, len);
-                            code++;
-                            *previous++ = OP_BRAZERO + repeatType;
-                        }
-                        
-                        /* If the maximum is greater than 1 and limited, we have to replicate
-                         in a nested fashion, sticking OP_BRAZERO before each set of brackets.
-                         The first one has to be handled carefully because it's the original
-                         copy, which has to be moved up. The remainder can be handled by code
-                         that is common with the non-zero minimum case below. We have to
-                         adjust the value of repeat_max, since one less copy is required. */
-                        
-                        else {
-                            *code = OP_END;
-                            memmove(previous + 2 + LINK_SIZE, previous, len);
-                            code += 2 + LINK_SIZE;
-                            *previous++ = OP_BRAZERO + repeatType;
-                            *previous++ = OP_BRA;
-                            
-                            /* We chain together the bracket offset fields that have to be
-                             filled in later when the ends of the brackets are reached. */
-                            
-                            int offset = (!bralink) ? 0 : previous - bralink;
-                            bralink = previous;
-                            putLinkValueAllowZeroAndAdvance(previous, offset);
-                        }
-                        
-                        repeat_max--;
-                    }
-                    
-                    /* If the minimum is greater than zero, replicate the group as many
-                     times as necessary, and adjust the maximum to the number of subsequent
-                     copies that we need. If we set a first char from the group, and didn't
-                     set a required char, copy the latter from the former. */
-                    
-                    else {
-                        if (repeatMin > 1) {
-                            if (didGroupSetFirstByte && reqByte < 0)
-                                reqByte = firstByte;
-                            for (int i = 1; i < repeatMin; i++) {
-                                memcpy(code, previous, len);
-                                code += len;
-                            }
-                        }
-                        if (repeat_max > 0)
-                            repeat_max -= repeatMin;
-                    }
-                    
-                    /* This code is common to both the zero and non-zero minimum cases. If
-                     the maximum is limited, it replicates the group in a nested fashion,
-                     remembering the bracket starts on a stack. In the case of a zero minimum,
-                     the first one was set up above. In all cases the repeat_max now specifies
-                     the number of additional copies needed. */
-                    
-                    if (repeat_max >= 0) {
-                        for (int i = repeat_max - 1; i >= 0; i--) {
-                            *code++ = OP_BRAZERO + repeatType;
-                            
-                            /* All but the final copy start a new nesting, maintaining the
-                             chain of brackets outstanding. */
-                            
-                            if (i != 0) {
-                                *code++ = OP_BRA;
-                                int offset = (!bralink) ? 0 : code - bralink;
-                                bralink = code;
-                                putLinkValueAllowZeroAndAdvance(code, offset);
-                            }
-                            
-                            memcpy(code, previous, len);
-                            code += len;
-                        }
-                        
-                        /* Now chain through the pending brackets, and fill in their length
-                         fields (which are holding the chain links pro tem). */
-                        
-                        while (bralink) {
-                            int offset = code - bralink + 1;
-                            unsigned char* bra = code - offset;
-                            int oldlinkoffset = getLinkValueAllowZero(bra + 1);
-                            bralink = (!oldlinkoffset) ? 0 : bralink - oldlinkoffset;
-                            *code++ = OP_KET;
-                            putLinkValueAndAdvance(code, offset);
-                            putLinkValue(bra + 1, offset);
-                        }
-                    }
-                    
-                    /* If the maximum is unlimited, set a repeater in the final copy. We
-                     can't just offset backwards from the current code point, because we
-                     don't know if there's been an options resetting after the ket. The
-                     correct offset was computed above. */
-                    
-                    else
-                        code[-ketoffset] = OP_KETRMAX + repeatType;
-                }
-                
-                // A quantifier after an assertion is mostly meaningless, but it
-                // can nullify the assertion if it has a 0 minimum.
-                else if (*previous == OP_ASSERT || *previous == OP_ASSERT_NOT) {
-                    if (repeatMin == 0) {
-                        code = previous;
-                        goto END_REPEAT;
-                    }
-                }
-                
-                /* Else there's some kind of shambles */
-                
-                else {
-                    *errorCodePtr = ERR11;
-                    goto FAILED;
-                }
-                
-                /* In all case we no longer have a previous item. We also set the
-                 "follows varying string" flag for subsequently encountered reqbytes if
-                 it isn't already set and we have just passed a varying length item. */
-                
-            END_REPEAT:
-                previous = NULL;
-                cd.reqVaryOpt |= reqvary;
-                break;
-                
-            /* Start of nested bracket sub-expression, or comment or lookahead or
-             lookbehind or option setting or condition. First deal with special things
-             that can come after a bracket; all are introduced by ?, and the appearance
-             of any of them means that this is not a referencing group. They were
-             checked for validity in the first pass over the string, so we don't have to
-             check for syntax errors here.  */
-                
-            case '(':
-                skipBytes = 0;
-                
-                if (*(++ptr) == '?') {
-                    switch (*(++ptr)) {
-                        case ':':                 /* Non-extracting bracket */
-                            bravalue = OP_BRA;
-                            ptr++;
-                            break;
-                            
-                        case '=':                 /* Positive lookahead */
-                            bravalue = OP_ASSERT;
-                            ptr++;
-                            break;
-                            
-                        case '!':                 /* Negative lookahead */
-                            bravalue = OP_ASSERT_NOT;
-                            ptr++;
-                            break;
-                            
-                        /* Character after (? not specially recognized */
-                            
-                        default:
-                            *errorCodePtr = ERR12;
-                            goto FAILED;
-                        }
-                }
-                
-                /* Else we have a referencing group; adjust the opcode. If the bracket
-                 number is greater than EXTRACT_BASIC_MAX, we set the opcode one higher, and
-                 arrange for the true number to follow later, in an OP_BRANUMBER item. */
-                
-                else {
-                    if (++(*brackets) > EXTRACT_BASIC_MAX) {
-                        bravalue = OP_BRA + EXTRACT_BASIC_MAX + 1;
-                        code[1 + LINK_SIZE] = OP_BRANUMBER;
-                        put2ByteValue(code + 2 + LINK_SIZE, *brackets);
-                        skipBytes = 3;
-                    }
-                    else
-                        bravalue = OP_BRA + *brackets;
-                }
-                
-                /* Process nested bracketed re. We copy code into a non-variable
-                 in order to be able to pass its address because some compilers
-                 complain otherwise. Pass in a new setting for the ims options
-                 if they have changed. */
-                
-                previous = code;
-                *code = bravalue;
-                tempcode = code;
-                tempreqvary = cd.reqVaryOpt;     /* Save value before bracket */
-                
-                if (!compileBracket(
-                                   options,
-                                   brackets,                     /* Extracting bracket count */
-                                   &tempcode,                    /* Where to put code (updated) */
-                                   &ptr,                         /* Input pointer (updated) */
-                                   patternEnd,
-                                   errorCodePtr,                 /* Where to put an error message */
-                                   skipBytes,                    /* Skip over OP_BRANUMBER */
-                                   &subFirstByte,                /* For possible first char */
-                                   &subReqByte,                  /* For possible last char */
-                                   cd))                          /* Tables block */
-                    goto FAILED;
-                
-                /* At the end of compiling, code is still pointing to the start of the
-                 group, while tempcode has been updated to point past the end of the group
-                 and any option resetting that may follow it. The pattern pointer (ptr)
-                 is on the bracket. */
-                
-                /* Handle updating of the required and first characters. Update for normal
-                 brackets of all kinds, and conditions with two branches (see code above).
-                 If the bracket is followed by a quantifier with zero repeat, we have to
-                 back off. Hence the definition of zeroReqByte and zeroFirstByte outside the
-                 main loop so that they can be accessed for the back off. */
-                
-                zeroReqByte = reqByte;
-                zeroFirstByte = firstByte;
-                didGroupSetFirstByte = false;
-                
-                if (bravalue >= OP_BRA) {
-                    /* If we have not yet set a firstByte in this branch, take it from the
-                     subpattern, remembering that it was set here so that a repeat of more
-                     than one can replicate it as reqByte if necessary. If the subpattern has
-                     no firstByte, set "none" for the whole branch. In both cases, a zero
-                     repeat forces firstByte to "none". */
-                    
-                    if (firstByte == REQ_UNSET) {
-                        if (subFirstByte >= 0) {
-                            firstByte = subFirstByte;
-                            didGroupSetFirstByte = true;
-                        }
-                        else
-                            firstByte = REQ_NONE;
-                        zeroFirstByte = REQ_NONE;
-                    }
-                    
-                    /* If firstByte was previously set, convert the subpattern's firstByte
-                     into reqByte if there wasn't one, using the vary flag that was in
-                     existence beforehand. */
-                    
-                    else if (subFirstByte >= 0 && subReqByte < 0)
-                        subReqByte = subFirstByte | tempreqvary;
-                    
-                    /* If the subpattern set a required byte (or set a first byte that isn't
-                     really the first byte - see above), set it. */
-                    
-                    if (subReqByte >= 0)
-                        reqByte = subReqByte;
-                }
-                
-                /* For a forward assertion, we take the reqByte, if set. This can be
-                 helpful if the pattern that follows the assertion doesn't set a different
-                 char. For example, it's useful for /(?=abcde).+/. We can't set firstByte
-                 for an assertion, however because it leads to incorrect effect for patterns
-                 such as /(?=a)a.+/ when the "real" "a" would then become a reqByte instead
-                 of a firstByte. This is overcome by a scan at the end if there's no
-                 firstByte, looking for an asserted first char. */
-                
-                else if (bravalue == OP_ASSERT && subReqByte >= 0)
-                    reqByte = subReqByte;
-                
-                /* Now update the main code pointer to the end of the group. */
-                
-                code = tempcode;
-                
-                /* Error if hit end of pattern */
-                
-                if (ptr >= patternEnd || *ptr != ')') {
-                    *errorCodePtr = ERR14;
-                    goto FAILED;
-                }
-                break;
-                
-            /* Check \ for being a real metacharacter; if not, fall through and handle
-             it as a data character at the start of a string. Escape items are checked
-             for validity in the pre-compiling pass. */
-                
-            case '\\':
-                tempptr = ptr;
-                c = checkEscape(&ptr, patternEnd, errorCodePtr, cd.numCapturingBrackets, false);
-                
-                /* Handle metacharacters introduced by \. For ones like \d, the ESC_ values
-                 are arranged to be the negation of the corresponding OP_values. For the
-                 back references, the values are ESC_REF plus the reference number. Only
-                 back references and those types that consume a character may be repeated.
-                 We can test for values between ESC_b and ESC_w for the latter; this may
-                 have to change if any new ones are ever created. */
-                
-                if (c < 0) {
-                    /* For metasequences that actually match a character, we disable the
-                     setting of a first character if it hasn't already been set. */
-                    
-                    if (firstByte == REQ_UNSET && -c > ESC_b && -c <= ESC_w)
-                        firstByte = REQ_NONE;
-                    
-                    /* Set values to reset to if this is followed by a zero repeat. */
-                    
-                    zeroFirstByte = firstByte;
-                    zeroReqByte = reqByte;
-                    
-                    /* Back references are handled specially */
-                    
-                    if (-c >= ESC_REF) {
-                        int number = -c - ESC_REF;
-                        previous = code;
-                        *code++ = OP_REF;
-                        put2ByteValueAndAdvance(code, number);
-                    }
-                    
-                    /* For the rest, we can obtain the OP value by negating the escape
-                     value */
-                    
-                    else {
-                        previous = (-c > ESC_b && -c <= ESC_w) ? code : NULL;
-                        *code++ = -c;
-                    }
-                    continue;
-                }
-                
-                /* Fall through. */
-                
-                /* Handle a literal character. It is guaranteed not to be whitespace or #
-                 when the extended flag is set. If we are in UTF-8 mode, it may be a
-                 multi-byte literal character. */
-                
-                default:
-            NORMAL_CHAR:
-                
-                previous = code;
-                
-                if (c < 128) {
-                    mcLength = 1;
-                    mcbuffer[0] = c;
-                    
-                    if ((options & IgnoreCaseOption) && (c | 0x20) >= 'a' && (c | 0x20) <= 'z') {
-                        *code++ = OP_ASCII_LETTER_IGNORING_CASE;
-                        *code++ = c | 0x20;
-                    } else {
-                        *code++ = OP_ASCII_CHAR;
-                        *code++ = c;
-                    }
-                } else {
-                    mcLength = encodeUTF8(c, mcbuffer);
-                    
-                    *code++ = (options & IgnoreCaseOption) ? OP_CHAR_IGNORING_CASE : OP_CHAR;
-                    for (c = 0; c < mcLength; c++)
-                        *code++ = mcbuffer[c];
-                }
-                
-                /* Set the first and required bytes appropriately. If no previous first
-                 byte, set it from this character, but revert to none on a zero repeat.
-                 Otherwise, leave the firstByte value alone, and don't change it on a zero
-                 repeat. */
-                
-                if (firstByte == REQ_UNSET) {
-                    zeroFirstByte = REQ_NONE;
-                    zeroReqByte = reqByte;
-                    
-                    /* If the character is more than one byte long, we can set firstByte
-                     only if it is not to be matched caselessly. */
-                    
-                    if (mcLength == 1 || reqCaseOpt == 0) {
-                        firstByte = mcbuffer[0] | reqCaseOpt;
-                        if (mcLength != 1)
-                            reqByte = code[-1] | cd.reqVaryOpt;
-                    }
-                    else
-                        firstByte = reqByte = REQ_NONE;
-                }
-                
-                /* firstByte was previously set; we can set reqByte only the length is
-                 1 or the matching is caseful. */
-                
-                else {
-                    zeroFirstByte = firstByte;
-                    zeroReqByte = reqByte;
-                    if (mcLength == 1 || reqCaseOpt == 0)
-                        reqByte = code[-1] | reqCaseOpt | cd.reqVaryOpt;
-                }
-                
-                break;            /* End of literal character handling */
-        }
-    }                   /* end of big loop */
-    
-    /* Control never reaches here by falling through, only by a goto for all the
-     error states. Pass back the position in the pattern so that it can be displayed
-     to the user for diagnosing the error. */
-    
-FAILED:
-    *ptrPtr = ptr;
-    return false;
-}
-
-/*************************************************
-*     Compile sequence of alternatives           *
-*************************************************/
-
-/* On entry, ptr is pointing past the bracket character, but on return
-it points to the closing bracket, or vertical bar, or end of string.
-The code variable is pointing at the byte into which the BRA operator has been
-stored. If the ims options are changed at the start (for a (?ims: group) or
-during any branch, we need to insert an OP_OPT item at the start of every
-following branch to ensure they get set correctly at run time, and also pass
-the new options into every subsequent branch compile.
-
-Argument:
-  options        option bits, including any changes for this subpattern
-  brackets       -> int containing the number of extracting brackets used
-  codePtr        -> the address of the current code pointer
-  ptrPtr         -> the address of the current pattern pointer
-  errorCodePtr   -> pointer to error code variable
-  skipBytes      skip this many bytes at start (for OP_BRANUMBER)
-  firstbyteptr   place to put the first required character, or a negative number
-  reqbyteptr     place to put the last required character, or a negative number
-  cd             points to the data block with tables pointers etc.
-
-Returns:      true on success
-*/
-
-static bool
-compileBracket(int options, int* brackets, unsigned char** codePtr,
-    const UChar** ptrPtr, const UChar* patternEnd, ErrorCode* errorCodePtr, int skipBytes,
-    int* firstbyteptr, int* reqbyteptr, CompileData& cd)
-{
-    const UChar* ptr = *ptrPtr;
-    unsigned char* code = *codePtr;
-    unsigned char* lastBranch = code;
-    unsigned char* start_bracket = code;
-    int firstByte = REQ_UNSET;
-    int reqByte = REQ_UNSET;
-    
-    /* Offset is set zero to mark that this bracket is still open */
-    
-    putLinkValueAllowZero(code + 1, 0);
-    code += 1 + LINK_SIZE + skipBytes;
-    
-    /* Loop for each alternative branch */
-    
-    while (true) {
-        /* Now compile the branch */
-        
-        int branchFirstByte;
-        int branchReqByte;
-        if (!compileBranch(options, brackets, &code, &ptr, patternEnd, errorCodePtr,
-                            &branchFirstByte, &branchReqByte, cd)) {
-            *ptrPtr = ptr;
-            return false;
-        }
-        
-        /* If this is the first branch, the firstByte and reqByte values for the
-         branch become the values for the regex. */
-        
-        if (*lastBranch != OP_ALT) {
-            firstByte = branchFirstByte;
-            reqByte = branchReqByte;
-        }
-        
-        /* If this is not the first branch, the first char and reqByte have to
-         match the values from all the previous branches, except that if the previous
-         value for reqByte didn't have REQ_VARY set, it can still match, and we set
-         REQ_VARY for the regex. */
-        
-        else {
-            /* If we previously had a firstByte, but it doesn't match the new branch,
-             we have to abandon the firstByte for the regex, but if there was previously
-             no reqByte, it takes on the value of the old firstByte. */
-            
-            if (firstByte >= 0 && firstByte != branchFirstByte) {
-                if (reqByte < 0)
-                    reqByte = firstByte;
-                firstByte = REQ_NONE;
-            }
-            
-            /* If we (now or from before) have no firstByte, a firstByte from the
-             branch becomes a reqByte if there isn't a branch reqByte. */
-            
-            if (firstByte < 0 && branchFirstByte >= 0 && branchReqByte < 0)
-                branchReqByte = branchFirstByte;
-            
-            /* Now ensure that the reqbytes match */
-            
-            if ((reqByte & ~REQ_VARY) != (branchReqByte & ~REQ_VARY))
-                reqByte = REQ_NONE;
-            else
-                reqByte |= branchReqByte;   /* To "or" REQ_VARY */
-        }
-        
-        /* Reached end of expression, either ')' or end of pattern. Go back through
-         the alternative branches and reverse the chain of offsets, with the field in
-         the BRA item now becoming an offset to the first alternative. If there are
-         no alternatives, it points to the end of the group. The length in the
-         terminating ket is always the length of the whole bracketed item. If any of
-         the ims options were changed inside the group, compile a resetting op-code
-         following, except at the very end of the pattern. Return leaving the pointer
-         at the terminating char. */
-        
-        if (ptr >= patternEnd || *ptr != '|') {
-            int length = code - lastBranch;
-            do {
-                int prevLength = getLinkValueAllowZero(lastBranch + 1);
-                putLinkValue(lastBranch + 1, length);
-                length = prevLength;
-                lastBranch -= length;
-            } while (length > 0);
-            
-            /* Fill in the ket */
-            
-            *code = OP_KET;
-            putLinkValue(code + 1, code - start_bracket);
-            code += 1 + LINK_SIZE;
-            
-            /* Set values to pass back */
-            
-            *codePtr = code;
-            *ptrPtr = ptr;
-            *firstbyteptr = firstByte;
-            *reqbyteptr = reqByte;
-            return true;
-        }
-        
-        /* Another branch follows; insert an "or" node. Its length field points back
-         to the previous branch while the bracket remains open. At the end the chain
-         is reversed. It's done like this so that the start of the bracket has a
-         zero offset until it is closed, making it possible to detect recursion. */
-        
-        *code = OP_ALT;
-        putLinkValue(code + 1, code - lastBranch);
-        lastBranch = code;
-        code += 1 + LINK_SIZE;
-        ptr++;
-    }
-    ASSERT_NOT_REACHED();
-}
-
-/*************************************************
-*          Check for anchored expression         *
-*************************************************/
-
-/* Try to find out if this is an anchored regular expression. Consider each
-alternative branch. If they all start OP_CIRC, or with a bracket
-all of whose alternatives start OP_CIRC (recurse ad lib), then
-it's anchored.
-
-Arguments:
-  code          points to start of expression (the bracket)
-  captureMap    a bitmap of which brackets we are inside while testing; this
-                 handles up to substring 31; all brackets after that share
-                 the zero bit
-  backrefMap    the back reference bitmap
-*/
-
-static bool branchIsAnchored(const unsigned char* code)
-{
-    const unsigned char* scode = firstSignificantOpcode(code);
-    int op = *scode;
-
-    /* Brackets */
-    if (op >= OP_BRA || op == OP_ASSERT)
-        return bracketIsAnchored(scode);
-
-    /* Check for explicit anchoring */    
-    return op == OP_CIRC;
-}
-
-static bool bracketIsAnchored(const unsigned char* code)
-{
-    do {
-        if (!branchIsAnchored(code + 1 + LINK_SIZE))
-            return false;
-        code += getLinkValue(code + 1);
-    } while (*code == OP_ALT);   /* Loop for each alternative */
-    return true;
-}
-
-/*************************************************
-*         Check for starting with ^ or .*        *
-*************************************************/
-
-/* This is called to find out if every branch starts with ^ or .* so that
-"first char" processing can be done to speed things up in multiline
-matching and for non-DOTALL patterns that start with .* (which must start at
-the beginning or after \n)
-
-Except when the .* appears inside capturing parentheses, and there is a
-subsequent back reference to those parentheses. By keeping a bitmap of the
-first 31 back references, we can catch some of the more common cases more
-precisely; all the greater back references share a single bit.
-
-Arguments:
-  code          points to start of expression (the bracket)
-  captureMap    a bitmap of which brackets we are inside while testing; this
-                 handles up to substring 31; all brackets after that share
-                 the zero bit
-  backrefMap    the back reference bitmap
-*/
-
-static bool branchNeedsLineStart(const unsigned char* code, unsigned captureMap, unsigned backrefMap)
-{
-    const unsigned char* scode = firstSignificantOpcode(code);
-    int op = *scode;
-    
-    /* Capturing brackets */
-    if (op > OP_BRA) {
-        int captureNum = op - OP_BRA;
-        if (captureNum > EXTRACT_BASIC_MAX)
-            captureNum = get2ByteValue(scode + 2 + LINK_SIZE);
-        int bracketMask = (captureNum < 32) ? (1 << captureNum) : 1;
-        return bracketNeedsLineStart(scode, captureMap | bracketMask, backrefMap);
-    }
-    
-    /* Other brackets */
-    if (op == OP_BRA || op == OP_ASSERT)
-        return bracketNeedsLineStart(scode, captureMap, backrefMap);
-    
-    /* .* means "start at start or after \n" if it isn't in brackets that
-     may be referenced. */
-    
-    if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
-        return scode[1] == OP_NOT_NEWLINE && !(captureMap & backrefMap);
-
-    /* Explicit ^ */
-    return op == OP_CIRC || op == OP_BOL;
-}
-
-static bool bracketNeedsLineStart(const unsigned char* code, unsigned captureMap, unsigned backrefMap)
-{
-    do {
-        if (!branchNeedsLineStart(code + 1 + LINK_SIZE, captureMap, backrefMap))
-            return false;
-        code += getLinkValue(code + 1);
-    } while (*code == OP_ALT);  /* Loop for each alternative */
-    return true;
-}
-
-/*************************************************
-*       Check for asserted fixed first char      *
-*************************************************/
-
-/* During compilation, the "first char" settings from forward assertions are
-discarded, because they can cause conflicts with actual literals that follow.
-However, if we end up without a first char setting for an unanchored pattern,
-it is worth scanning the regex to see if there is an initial asserted first
-char. If all branches start with the same asserted char, or with a bracket all
-of whose alternatives start with the same asserted char (recurse ad lib), then
-we return that char, otherwise -1.
-
-Arguments:
-  code       points to start of expression (the bracket)
-  options    pointer to the options (used to check casing changes)
-  inassert   true if in an assertion
-
-Returns:     -1 or the fixed first char
-*/
-
-static int branchFindFirstAssertedCharacter(const unsigned char* code, bool inassert)
-{
-    const unsigned char* scode = firstSignificantOpcodeSkippingAssertions(code);
-    int op = *scode;
-    
-    if (op >= OP_BRA)
-        op = OP_BRA;
-    
-    switch (op) {
-        default:
-            return -1;
-            
-        case OP_BRA:
-        case OP_ASSERT:
-            return bracketFindFirstAssertedCharacter(scode, op == OP_ASSERT);
-
-        case OP_EXACT:
-            scode += 2;
-            /* Fall through */
-
-        case OP_CHAR:
-        case OP_CHAR_IGNORING_CASE:
-        case OP_ASCII_CHAR:
-        case OP_ASCII_LETTER_IGNORING_CASE:
-        case OP_PLUS:
-        case OP_MINPLUS:
-            if (!inassert)
-                return -1;
-            return scode[1];
-    }
-}
-
-static int bracketFindFirstAssertedCharacter(const unsigned char* code, bool inassert)
-{
-    int c = -1;
-    do {
-        int d = branchFindFirstAssertedCharacter(code + 1 + LINK_SIZE, inassert);
-        if (d < 0)
-            return -1;
-        if (c < 0)
-            c = d;
-        else if (c != d)
-            return -1;
-        code += getLinkValue(code + 1);
-    } while (*code == OP_ALT);
-    return c;
-}
-
-static inline int multiplyWithOverflowCheck(int a, int b)
-{
-    if (!a || !b)
-        return 0;
-    if (a > MAX_PATTERN_SIZE / b)
-        return -1;
-    return a * b;
-}
-
-static int calculateCompiledPatternLength(const UChar* pattern, int patternLength, JSRegExpIgnoreCaseOption ignoreCase,
-    CompileData& cd, ErrorCode& errorcode)
-{
-    /* Make a pass over the pattern to compute the
-     amount of store required to hold the compiled code. This does not have to be
-     perfect as long as errors are overestimates. */
-
-    if (patternLength > MAX_PATTERN_SIZE) {
-        errorcode = ERR16;
-        return -1;
-    }
-
-    int length = 1 + LINK_SIZE;      /* For initial BRA plus length */
-    int branch_extra = 0;
-    int lastitemlength = 0;
-    unsigned brastackptr = 0;
-    FixedArray<int, BRASTACK_SIZE> brastack;
-    FixedArray<unsigned char, BRASTACK_SIZE> bralenstack;
-    int bracount = 0;
-    
-    const UChar* ptr = (const UChar*)(pattern - 1);
-    const UChar* patternEnd = (const UChar*)(pattern + patternLength);
-    
-    while (++ptr < patternEnd) {
-        int minRepeats = 0, maxRepeats = 0;
-        int c = *ptr;
-
-        switch (c) {
-            /* A backslashed item may be an escaped data character or it may be a
-             character type. */
-
-            case '\\':
-                c = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, false);
-                if (errorcode != 0)
-                    return -1;
-                
-                lastitemlength = 1;     /* Default length of last item for repeats */
-                
-                if (c >= 0) {            /* Data character */
-                    length += 2;          /* For a one-byte character */
-                    
-                    if (c > 127) {
-                        int i;
-                        for (i = 0; i < jsc_pcre_utf8_table1_size; i++)
-                            if (c <= jsc_pcre_utf8_table1[i]) break;
-                        length += i;
-                        lastitemlength += i;
-                    }
-                    
-                    continue;
-                }
-                
-                /* Other escapes need one byte */
-                
-                length++;
-                
-                /* A back reference needs an additional 2 bytes, plus either one or 5
-                 bytes for a repeat. We also need to keep the value of the highest
-                 back reference. */
-                
-                if (c <= -ESC_REF) {
-                    int refnum = -c - ESC_REF;
-                    cd.backrefMap |= (refnum < 32) ? (1 << refnum) : 1;
-                    if (refnum > cd.topBackref)
-                        cd.topBackref = refnum;
-                    length += 2;   /* For single back reference */
-                    if (safelyCheckNextChar(ptr, patternEnd, '{') && isCountedRepeat(ptr + 2, patternEnd)) {
-                        ptr = readRepeatCounts(ptr + 2, &minRepeats, &maxRepeats, &errorcode);
-                        if (errorcode)
-                            return -1;
-                        if ((minRepeats == 0 && (maxRepeats == 1 || maxRepeats == -1)) ||
-                            (minRepeats == 1 && maxRepeats == -1))
-                            length++;
-                        else
-                            length += 5;
-                        if (safelyCheckNextChar(ptr, patternEnd, '?'))
-                            ptr++;
-                    }
-                }
-                continue;
-                
-            case '^':     /* Single-byte metacharacters */
-            case '.':
-            case '$':
-                length++;
-                lastitemlength = 1;
-                continue;
-                
-            case '*':            /* These repeats won't be after brackets; */
-            case '+':            /* those are handled separately */
-            case '?':
-                length++;
-                goto POSSESSIVE;
-                
-            /* This covers the cases of braced repeats after a single char, metachar,
-             class, or back reference. */
-
-            case '{':
-                if (!isCountedRepeat(ptr + 1, patternEnd))
-                    goto NORMAL_CHAR;
-                ptr = readRepeatCounts(ptr + 1, &minRepeats, &maxRepeats, &errorcode);
-                if (errorcode != 0)
-                    return -1;
-                
-                /* These special cases just insert one extra opcode */
-                
-                if ((minRepeats == 0 && (maxRepeats == 1 || maxRepeats == -1)) ||
-                    (minRepeats == 1 && maxRepeats == -1))
-                    length++;
-                
-                /* These cases might insert additional copies of a preceding character. */
-                
-                else {
-                    if (minRepeats != 1) {
-                        length -= lastitemlength;   /* Uncount the original char or metachar */
-                        if (minRepeats > 0)
-                            length += 3 + lastitemlength;
-                    }
-                    length += lastitemlength + ((maxRepeats > 0) ? 3 : 1);
-                }
-                
-                if (safelyCheckNextChar(ptr, patternEnd, '?'))
-                    ptr++;      /* Needs no extra length */
-
-            POSSESSIVE:                     /* Test for possessive quantifier */
-                if (safelyCheckNextChar(ptr, patternEnd, '+')) {
-                    ptr++;
-                    length += 2 + 2 * LINK_SIZE;   /* Allow for atomic brackets */
-                }
-                continue;
-                
-            /* An alternation contains an offset to the next branch or ket. If any ims
-             options changed in the previous branch(es), and/or if we are in a
-             lookbehind assertion, extra space will be needed at the start of the
-             branch. This is handled by branch_extra. */
-                
-            case '|':
-                if (brastackptr == 0)
-                    cd.needOuterBracket = true;
-                length += 1 + LINK_SIZE + branch_extra;
-                continue;
-                
-            /* A character class uses 33 characters provided that all the character
-             values are less than 256. Otherwise, it uses a bit map for low valued
-             characters, and individual items for others. Don't worry about character
-             types that aren't allowed in classes - they'll get picked up during the
-             compile. A character class that contains only one single-byte character
-             uses 2 or 3 bytes, depending on whether it is negated or not. Notice this
-             where we can. (In UTF-8 mode we can do this only for chars < 128.) */
-                
-            case '[': {
-                int class_optcount;
-                if (*(++ptr) == '^') {
-                    class_optcount = 10;  /* Greater than one */
-                    ptr++;
-                }
-                else
-                    class_optcount = 0;
-                
-                bool class_utf8 = false;
-                
-                for (; ptr < patternEnd && *ptr != ']'; ++ptr) {
-                    /* Check for escapes */
-                    
-                    if (*ptr == '\\') {
-                        c = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, true);
-                        if (errorcode != 0)
-                            return -1;
-                        
-                        /* Handle escapes that turn into characters */
-                        
-                        if (c >= 0)
-                            goto NON_SPECIAL_CHARACTER;
-                        
-                        /* Escapes that are meta-things. The normal ones just affect the
-                         bit map, but Unicode properties require an XCLASS extended item. */
-                        
-                        else
-                            class_optcount = 10;         /* \d, \s etc; make sure > 1 */
-                    }
-                    
-                    /* Anything else increments the possible optimization count. We have to
-                     detect ranges here so that we can compute the number of extra ranges for
-                     caseless wide characters when UCP support is available. If there are wide
-                     characters, we are going to have to use an XCLASS, even for single
-                     characters. */
-                    
-                    else {
-                        c = *ptr;
-                        
-                        /* Come here from handling \ above when it escapes to a char value */
-                        
-                    NON_SPECIAL_CHARACTER:
-                        class_optcount++;
-                        
-                        int d = -1;
-                        if (safelyCheckNextChar(ptr, patternEnd, '-')) {
-                            const UChar* hyptr = ptr++;
-                            if (safelyCheckNextChar(ptr, patternEnd, '\\')) {
-                                ptr++;
-                                d = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, true);
-                                if (errorcode != 0)
-                                    return -1;
-                            }
-                            else if ((ptr + 1 < patternEnd) && ptr[1] != ']')
-                                d = *++ptr;
-                            if (d < 0)
-                                ptr = hyptr;      /* go back to hyphen as data */
-                        }
-                        
-                        /* If d >= 0 we have a range. In UTF-8 mode, if the end is > 255, or >
-                         127 for caseless matching, we will need to use an XCLASS. */
-                        
-                        if (d >= 0) {
-                            class_optcount = 10;     /* Ensure > 1 */
-                            if (d < c) {
-                                errorcode = ERR8;
-                                return -1;
-                            }
-                            
-                            if ((d > 255 || (ignoreCase && d > 127))) {
-                                unsigned char buffer[6];
-                                if (!class_utf8)         /* Allow for XCLASS overhead */
-                                {
-                                    class_utf8 = true;
-                                    length += LINK_SIZE + 2;
-                                }
-                                
-                                /* If we have UCP support, find out how many extra ranges are
-                                 needed to map the other case of characters within this range. We
-                                 have to mimic the range optimization here, because extending the
-                                 range upwards might push d over a boundary that makes it use
-                                 another byte in the UTF-8 representation. */
-                                
-                                if (ignoreCase) {
-                                    int occ, ocd;
-                                    int cc = c;
-                                    int origd = d;
-                                    while (getOthercaseRange(&cc, origd, &occ, &ocd)) {
-                                        if (occ >= c && ocd <= d)
-                                            continue;   /* Skip embedded */
-                                        
-                                        if (occ < c  && ocd >= c - 1)  /* Extend the basic range */
-                                        {                            /* if there is overlap,   */
-                                            c = occ;                     /* noting that if occ < c */
-                                            continue;                    /* we can't have ocd > d  */
-                                        }                            /* because a subrange is  */
-                                        if (ocd > d && occ <= d + 1)   /* always shorter than    */
-                                        {                            /* the basic range.       */
-                                            d = ocd;
-                                            continue;
-                                        }
-                                        
-                                        /* An extra item is needed */
-                                        
-                                        length += 1 + encodeUTF8(occ, buffer) +
-                                        ((occ == ocd) ? 0 : encodeUTF8(ocd, buffer));
-                                    }
-                                }
-                                
-                                /* The length of the (possibly extended) range */
-                                
-                                length += 1 + encodeUTF8(c, buffer) + encodeUTF8(d, buffer);
-                            }
-                            
-                        }
-                        
-                        /* We have a single character. There is nothing to be done unless we
-                         are in UTF-8 mode. If the char is > 255, or 127 when caseless, we must
-                         allow for an XCL_SINGLE item, doubled for caselessness if there is UCP
-                         support. */
-                        
-                        else {
-                            if ((c > 255 || (ignoreCase && c > 127))) {
-                                unsigned char buffer[6];
-                                class_optcount = 10;     /* Ensure > 1 */
-                                if (!class_utf8)         /* Allow for XCLASS overhead */
-                                {
-                                    class_utf8 = true;
-                                    length += LINK_SIZE + 2;
-                                }
-                                length += (ignoreCase ? 2 : 1) * (1 + encodeUTF8(c, buffer));
-                            }
-                        }
-                    }
-                }
-                
-                if (ptr >= patternEnd) {   /* Missing terminating ']' */
-                    errorcode = ERR6;
-                    return -1;
-                }
-                
-                /* We can optimize when there was only one optimizable character.
-                 Note that this does not detect the case of a negated single character.
-                 In that case we do an incorrect length computation, but it's not a serious
-                 problem because the computed length is too large rather than too small. */
-
-                if (class_optcount == 1)
-                    goto NORMAL_CHAR;
-
-                /* Here, we handle repeats for the class opcodes. */
-                {
-                    length += 33;
-                    
-                    /* A repeat needs either 1 or 5 bytes. If it is a possessive quantifier,
-                     we also need extra for wrapping the whole thing in a sub-pattern. */
-                    
-                    if (safelyCheckNextChar(ptr, patternEnd, '{') && isCountedRepeat(ptr + 2, patternEnd)) {
-                        ptr = readRepeatCounts(ptr + 2, &minRepeats, &maxRepeats, &errorcode);
-                        if (errorcode != 0)
-                            return -1;
-                        if ((minRepeats == 0 && (maxRepeats == 1 || maxRepeats == -1)) ||
-                            (minRepeats == 1 && maxRepeats == -1))
-                            length++;
-                        else
-                            length += 5;
-                        if (safelyCheckNextChar(ptr, patternEnd, '+')) {
-                            ptr++;
-                            length += 2 + 2 * LINK_SIZE;
-                        } else if (safelyCheckNextChar(ptr, patternEnd, '?'))
-                            ptr++;
-                    }
-                }
-                continue;
-            }
-
-            /* Brackets may be genuine groups or special things */
-                
-            case '(': {
-                int branch_newextra = 0;
-                int bracket_length = 1 + LINK_SIZE;
-                bool capturing = false;
-                
-                /* Handle special forms of bracket, which all start (? */
-                
-                if (safelyCheckNextChar(ptr, patternEnd, '?')) {
-                    switch (c = (ptr + 2 < patternEnd ? ptr[2] : 0)) {
-                        /* Non-referencing groups and lookaheads just move the pointer on, and
-                         then behave like a non-special bracket, except that they don't increment
-                         the count of extracting brackets. Ditto for the "once only" bracket,
-                         which is in Perl from version 5.005. */
-                            
-                        case ':':
-                        case '=':
-                        case '!':
-                            ptr += 2;
-                            break;
-                            
-                        /* Else loop checking valid options until ) is met. Anything else is an
-                         error. If we are without any brackets, i.e. at top level, the settings
-                         act as if specified in the options, so massage the options immediately.
-                         This is for backward compatibility with Perl 5.004. */
-                            
-                        default:
-                            errorcode = ERR12;
-                            return -1;
-                    }
-                } else
-                    capturing = 1;
-                
-                /* Capturing brackets must be counted so we can process escapes in a
-                 Perlish way. If the number exceeds EXTRACT_BASIC_MAX we are going to need
-                 an additional 3 bytes of memory per capturing bracket. */
-                
-                if (capturing) {
-                    bracount++;
-                    if (bracount > EXTRACT_BASIC_MAX)
-                        bracket_length += 3;
-                }
-                
-                /* Save length for computing whole length at end if there's a repeat that
-                 requires duplication of the group. Also save the current value of
-                 branch_extra, and start the new group with the new value. If non-zero, this
-                 will either be 2 for a (?imsx: group, or 3 for a lookbehind assertion. */
-                
-                if (brastackptr >= sizeof(brastack)/sizeof(int)) {
-                    errorcode = ERR17;
-                    return -1;
-                }
-                
-                bralenstack[brastackptr] = branch_extra;
-                branch_extra = branch_newextra;
-                
-                brastack[brastackptr++] = length;
-                length += bracket_length;
-                continue;
-            }
-
-            /* Handle ket. Look for subsequent maxRepeats/minRepeats; for certain sets of values we
-             have to replicate this bracket up to that many times. If brastackptr is
-             0 this is an unmatched bracket which will generate an error, but take care
-             not to try to access brastack[-1] when computing the length and restoring
-             the branch_extra value. */
-
-            case ')': {
-                int duplength;
-                length += 1 + LINK_SIZE;
-                if (brastackptr > 0) {
-                    duplength = length - brastack[--brastackptr];
-                    branch_extra = bralenstack[brastackptr];
-                }
-                else
-                    duplength = 0;
-                
-                /* Leave ptr at the final char; for readRepeatCounts this happens
-                 automatically; for the others we need an increment. */
-                
-                if ((ptr + 1 < patternEnd) && (c = ptr[1]) == '{' && isCountedRepeat(ptr + 2, patternEnd)) {
-                    ptr = readRepeatCounts(ptr + 2, &minRepeats, &maxRepeats, &errorcode);
-                    if (errorcode)
-                        return -1;
-                } else if (c == '*') {
-                    minRepeats = 0;
-                    maxRepeats = -1;
-                    ptr++;
-                } else if (c == '+') {
-                    minRepeats = 1;
-                    maxRepeats = -1;
-                    ptr++;
-                } else if (c == '?') {
-                    minRepeats = 0;
-                    maxRepeats = 1;
-                    ptr++;
-                } else {
-                    minRepeats = 1;
-                    maxRepeats = 1;
-                }
-                
-                /* If the minimum is zero, we have to allow for an OP_BRAZERO before the
-                 group, and if the maximum is greater than zero, we have to replicate
-                 maxval-1 times; each replication acquires an OP_BRAZERO plus a nesting
-                 bracket set. */
-                
-                int repeatsLength;
-                if (minRepeats == 0) {
-                    length++;
-                    if (maxRepeats > 0) {
-                        repeatsLength = multiplyWithOverflowCheck(maxRepeats - 1, duplength + 3 + 2 * LINK_SIZE);
-                        if (repeatsLength < 0) {
-                            errorcode = ERR16;
-                            return -1;
-                        }
-                        length += repeatsLength;
-                        if (length > MAX_PATTERN_SIZE) {
-                            errorcode = ERR16;
-                            return -1;
-                        }
-                    }
-                }
-                
-                /* When the minimum is greater than zero, we have to replicate up to
-                 minval-1 times, with no additions required in the copies. Then, if there
-                 is a limited maximum we have to replicate up to maxval-1 times allowing
-                 for a BRAZERO item before each optional copy and nesting brackets for all
-                 but one of the optional copies. */
-                
-                else {
-                    repeatsLength = multiplyWithOverflowCheck(minRepeats - 1, duplength);
-                    if (repeatsLength < 0) {
-                        errorcode = ERR16;
-                        return -1;
-                    }
-                    length += repeatsLength;
-                    if (maxRepeats > minRepeats) { /* Need this test as maxRepeats=-1 means no limit */
-                        repeatsLength = multiplyWithOverflowCheck(maxRepeats - minRepeats, duplength + 3 + 2 * LINK_SIZE);
-                        if (repeatsLength < 0) {
-                            errorcode = ERR16;
-                            return -1;
-                        }
-                        length += repeatsLength - (2 + 2 * LINK_SIZE);
-                    }
-                    if (length > MAX_PATTERN_SIZE) {
-                        errorcode = ERR16;
-                        return -1;
-                    }
-                }
-                
-                /* Allow space for once brackets for "possessive quantifier" */
-                
-                if (safelyCheckNextChar(ptr, patternEnd, '+')) {
-                    ptr++;
-                    length += 2 + 2 * LINK_SIZE;
-                }
-                continue;
-            }
-
-            /* Non-special character. It won't be space or # in extended mode, so it is
-             always a genuine character. If we are in a \Q...\E sequence, check for the
-             end; if not, we have a literal. */
-                
-            default:
-            NORMAL_CHAR:
-                length += 2;          /* For a one-byte character */
-                lastitemlength = 1;   /* Default length of last item for repeats */
-
-                if (c > 127) {
-                    int i;
-                    for (i = 0; i < jsc_pcre_utf8_table1_size; i++)
-                        if (c <= jsc_pcre_utf8_table1[i])
-                            break;
-                    length += i;
-                    lastitemlength += i;
-                }
-                
-                continue;
-        }
-    }
-    
-    length += 2 + LINK_SIZE;    /* For final KET and END */
-
-    cd.numCapturingBrackets = bracount;
-    return length;
-}
-
-/*************************************************
-*        Compile a Regular Expression            *
-*************************************************/
-
-/* This function takes a string and returns a pointer to a block of store
-holding a compiled version of the expression. The original API for this
-function had no error code return variable; it is retained for backwards
-compatibility. The new function is given a new name.
-
-Arguments:
-  pattern       the regular expression
-  options       various option bits
-  errorCodePtr  pointer to error code variable (pcre_compile2() only)
-                  can be NULL if you don't want a code value
-  errorPtr      pointer to pointer to error text
-  erroroffset   ptr offset in pattern where error was detected
-  tables        pointer to character tables or NULL
-
-Returns:        pointer to compiled data block, or NULL on error,
-                with errorPtr and erroroffset set
-*/
-
-static inline JSRegExp* returnError(ErrorCode errorcode, const char** errorPtr)
-{
-    *errorPtr = errorText(errorcode);
-    return 0;
-}
-
-JSRegExp* jsRegExpCompile(const UChar* pattern, int patternLength,
-                JSRegExpIgnoreCaseOption ignoreCase, JSRegExpMultilineOption multiline,
-                unsigned* numSubpatterns, const char** errorPtr)
-{
-    /* We can't pass back an error message if errorPtr is NULL; I guess the best we
-     can do is just return NULL, but we can set a code value if there is a code pointer. */
-    if (!errorPtr)
-        return 0;
-    *errorPtr = NULL;
-    
-    CompileData cd;
-    
-    ErrorCode errorcode = ERR0;
-    /* Call this once just to count the brackets. */
-    calculateCompiledPatternLength(pattern, patternLength, ignoreCase, cd, errorcode);
-    /* Call it again to compute the length. */
-    int length = calculateCompiledPatternLength(pattern, patternLength, ignoreCase, cd, errorcode);
-    if (errorcode)
-        return returnError(errorcode, errorPtr);
-    
-    if (length > MAX_PATTERN_SIZE)
-        return returnError(ERR16, errorPtr);
-    
-    size_t size = length + sizeof(JSRegExp);
-#if REGEXP_HISTOGRAM
-    size_t stringOffset = (size + sizeof(UChar) - 1) / sizeof(UChar) * sizeof(UChar);
-    size = stringOffset + patternLength * sizeof(UChar);
-#endif
-    JSRegExp* re = reinterpret_cast_ptr<JSRegExp*>(new char[size]);
-    
-    if (!re)
-        return returnError(ERR13, errorPtr);
-    
-    re->options = (ignoreCase ? IgnoreCaseOption : 0) | (multiline ? MatchAcrossMultipleLinesOption : 0);
-    
-    /* The starting points of the name/number translation table and of the code are
-     passed around in the compile data block. */
-    
-    const unsigned char* codeStart = (const unsigned char*)(re + 1);
-    
-    /* Set up a starting, non-extracting bracket, then compile the expression. On
-     error, errorcode will be set non-zero, so we don't need to look at the result
-     of the function here. */
-    
-    const UChar* ptr = (const UChar*)pattern;
-    const UChar* patternEnd = pattern + patternLength;
-    unsigned char* code = const_cast<unsigned char*>(codeStart);
-    int firstByte, reqByte;
-    int bracketCount = 0;
-    if (!cd.needOuterBracket)
-        compileBranch(re->options, &bracketCount, &code, &ptr, patternEnd, &errorcode, &firstByte, &reqByte, cd);
-    else {
-        *code = OP_BRA;
-        compileBracket(re->options, &bracketCount, &code, &ptr, patternEnd, &errorcode, 0, &firstByte, &reqByte, cd);
-    }
-    re->topBracket = bracketCount;
-    re->topBackref = cd.topBackref;
-    
-    /* If not reached end of pattern on success, there's an excess bracket. */
-    
-    if (errorcode == 0 && ptr < patternEnd)
-        errorcode = ERR10;
-    
-    /* Fill in the terminating state and check for disastrous overflow, but
-     if debugging, leave the test till after things are printed out. */
-    
-    *code++ = OP_END;
-
-    ASSERT(code - codeStart <= length);
-    if (code - codeStart > length)
-        errorcode = ERR7;
-    
-    /* Give an error if there's back reference to a non-existent capturing
-     subpattern. */
-    
-    if (re->topBackref > re->topBracket)
-        errorcode = ERR15;
-    
-    /* Failed to compile, or error while post-processing */
-    
-    if (errorcode != ERR0) {
-        delete [] reinterpret_cast<char*>(re);
-        return returnError(errorcode, errorPtr);
-    }
-    
-    /* If the anchored option was not passed, set the flag if we can determine that
-     the pattern is anchored by virtue of ^ characters or \A or anything else (such
-     as starting with .* when DOTALL is set).
-     
-     Otherwise, if we know what the first character has to be, save it, because that
-     speeds up unanchored matches no end. If not, see if we can set the
-     UseMultiLineFirstByteOptimizationOption flag. This is helpful for multiline matches when all branches
-     start with ^. and also when all branches start with .* for non-DOTALL matches.
-     */
-    
-    if (cd.needOuterBracket ? bracketIsAnchored(codeStart) : branchIsAnchored(codeStart))
-        re->options |= IsAnchoredOption;
-    else {
-        if (firstByte < 0) {
-            firstByte = (cd.needOuterBracket
-                    ? bracketFindFirstAssertedCharacter(codeStart, false)
-                    : branchFindFirstAssertedCharacter(codeStart, false))
-                | ((re->options & IgnoreCaseOption) ? REQ_IGNORE_CASE : 0);
-        }
-        if (firstByte >= 0) {
-            int ch = firstByte & 255;
-            if (ch < 127) {
-                re->firstByte = ((firstByte & REQ_IGNORE_CASE) && flipCase(ch) == ch) ? ch : firstByte;
-                re->options |= UseFirstByteOptimizationOption;
-            }
-        } else {
-            if (cd.needOuterBracket ? bracketNeedsLineStart(codeStart, 0, cd.backrefMap) : branchNeedsLineStart(codeStart, 0, cd.backrefMap))
-                re->options |= UseMultiLineFirstByteOptimizationOption;
-        }
-    }
-    
-    /* For an anchored pattern, we use the "required byte" only if it follows a
-     variable length item in the regex. Remove the caseless flag for non-caseable
-     bytes. */
-    
-    if (reqByte >= 0 && (!(re->options & IsAnchoredOption) || (reqByte & REQ_VARY))) {
-        int ch = reqByte & 255;
-        if (ch < 127) {
-            re->reqByte = ((reqByte & REQ_IGNORE_CASE) && flipCase(ch) == ch) ? (reqByte & ~REQ_IGNORE_CASE) : reqByte;
-            re->options |= UseRequiredByteOptimizationOption;
-        }
-    }
-    
-#if REGEXP_HISTOGRAM
-    re->stringOffset = stringOffset;
-    re->stringLength = patternLength;
-    memcpy(reinterpret_cast<char*>(re) + stringOffset, pattern, patternLength * 2);
-#endif
-
-    if (numSubpatterns)
-        *numSubpatterns = re->topBracket;
-    return re;
-}
-
-void jsRegExpFree(JSRegExp* re)
-{
-    delete [] reinterpret_cast<char*>(re);
-}
diff --git a/Source/JavaScriptCore/pcre/pcre_exec.cpp b/Source/JavaScriptCore/pcre/pcre_exec.cpp
deleted file mode 100644
index b7018aa..0000000
--- a/Source/JavaScriptCore/pcre/pcre_exec.cpp
+++ /dev/null
@@ -1,2179 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/* This module contains jsRegExpExecute(), the externally visible function
-that does pattern matching using an NFA algorithm, following the rules from
-the JavaScript specification. There are also some supporting functions. */
-
-#include "config.h"
-#include "pcre_internal.h"
-
-#include <limits.h>
-#include <wtf/ASCIICType.h>
-#include <wtf/Vector.h>
-
-#if REGEXP_HISTOGRAM
-#include <wtf/DateMath.h>
-#include <runtime/UString.h>
-#endif
-
-using namespace WTF;
-
-#if HAVE(COMPUTED_GOTO)
-#define USE_COMPUTED_GOTO_FOR_MATCH_RECURSION
-//#define USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-#endif
-
-/* Avoid warnings on Windows. */
-#undef min
-#undef max
-
-#ifndef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION
-typedef int ReturnLocation;
-#else
-typedef void* ReturnLocation;
-#endif
-
-#if !REGEXP_HISTOGRAM
-
-class HistogramTimeLogger {
-public:
-    HistogramTimeLogger(const JSRegExp*) { }
-};
-
-#else
-
-using namespace JSC;
-
-class Histogram {
-public:
-    ~Histogram();
-    void add(const JSRegExp*, double);
-
-private:
-    typedef HashMap<RefPtr<StringImpl>, double> Map;
-    Map times;
-};
-
-class HistogramTimeLogger {
-public:
-    HistogramTimeLogger(const JSRegExp*);
-    ~HistogramTimeLogger();
-
-private:
-    const JSRegExp* m_re;
-    double m_startTime;
-};
-
-#endif
-
-/* Structure for building a chain of data for holding the values of
-the subject pointer at the start of each bracket, used to detect when
-an empty string has been matched by a bracket to break infinite loops. */ 
-struct BracketChainNode {
-    BracketChainNode* previousBracket;
-    const UChar* bracketStart;
-};
-
-struct MatchFrame {
-    WTF_MAKE_FAST_ALLOCATED;
-public:
-    ReturnLocation returnLocation;
-    struct MatchFrame* previousFrame;
-    
-    /* Function arguments that may change */
-    struct {
-        const UChar* subjectPtr;
-        const unsigned char* instructionPtr;
-        int offsetTop;
-        BracketChainNode* bracketChain;
-    } args;
-    
-    
-    /* PCRE uses "fake" recursion built off of gotos, thus
-     stack-based local variables are not safe to use.  Instead we have to
-     store local variables on the current MatchFrame. */
-    struct {
-        const unsigned char* data;
-        const unsigned char* startOfRepeatingBracket;
-        const UChar* subjectPtrAtStartOfInstruction; // Several instrutions stash away a subjectPtr here for later compare
-        const unsigned char* instructionPtrAtStartOfOnce;
-        
-        int repeatOthercase;
-        
-        int ctype;
-        int fc;
-        int fi;
-        int length;
-        int max;
-        int number;
-        int offset;
-        int saveOffset1;
-        int saveOffset2;
-        int saveOffset3;
-        
-        BracketChainNode bracketChainNode;
-    } locals;
-};
-
-/* Structure for passing "static" information around between the functions
-doing traditional NFA matching, so that they are thread-safe. */
-
-struct MatchData {
-  int*   offsetVector;         /* Offset vector */
-  int    offsetEnd;            /* One past the end */
-  int    offsetMax;            /* The maximum usable for return data */
-  bool   offsetOverflow;       /* Set if too many extractions */
-  const UChar*  startSubject;         /* Start of the subject string */
-  const UChar*  endSubject;           /* End of the subject string */
-  const UChar*  endMatchPtr;         /* Subject position at end match */
-  int    endOffsetTop;        /* Highwater mark at end of match */
-  bool   multiline;
-  bool   ignoreCase;
-};
-
-/* The maximum remaining length of subject we are prepared to search for a
-reqByte match. */
-
-#define REQ_BYTE_MAX 1000
-
-/* The below limit restricts the number of "recursive" match calls in order to
-avoid spending exponential time on complex regular expressions. */
-
-static const unsigned matchLimit = 1000000;
-
-#ifdef DEBUG
-/*************************************************
-*        Debugging function to print chars       *
-*************************************************/
-
-/* Print a sequence of chars in printable format, stopping at the end of the
-subject if the requested.
-
-Arguments:
-  p           points to characters
-  length      number to print
-  isSubject  true if printing from within md.startSubject
-  md          pointer to matching data block, if isSubject is true
-*/
-
-static void pchars(const UChar* p, int length, bool isSubject, const MatchData& md)
-{
-    if (isSubject && length > md.endSubject - p)
-        length = md.endSubject - p;
-    while (length-- > 0) {
-        int c;
-        if (isASCIIPrintable(c = *(p++)))
-            printf("%c", c);
-        else if (c < 256)
-            printf("\\x%02x", c);
-        else
-            printf("\\x{%x}", c);
-    }
-}
-#endif
-
-/*************************************************
-*          Match a back-reference                *
-*************************************************/
-
-/* If a back reference hasn't been set, the length that is passed is greater
-than the number of characters left in the string, so the match fails.
-
-Arguments:
-  offset      index into the offset vector
-  subjectPtr        points into the subject
-  length      length to be matched
-  md          points to match data block
-
-Returns:      true if matched
-*/
-
-static bool matchRef(int offset, const UChar* subjectPtr, int length, const MatchData& md)
-{
-    const UChar* p = md.startSubject + md.offsetVector[offset];
-    
-#ifdef DEBUG
-    if (subjectPtr >= md.endSubject)
-        printf("matching subject <null>");
-    else {
-        printf("matching subject ");
-        pchars(subjectPtr, length, true, md);
-    }
-    printf(" against backref ");
-    pchars(p, length, false, md);
-    printf("\n");
-#endif
-    
-    /* Always fail if not enough characters left */
-    
-    if (length > md.endSubject - subjectPtr)
-        return false;
-    
-    /* Separate the caselesss case for speed */
-    
-    if (md.ignoreCase) {
-        while (length-- > 0) {
-            UChar c = *p++;
-            int othercase = jsc_pcre_ucp_othercase(c);
-            UChar d = *subjectPtr++;
-            if (c != d && othercase != d)
-                return false;
-        }
-    }
-    else {
-        while (length-- > 0)
-            if (*p++ != *subjectPtr++)
-                return false;
-    }
-    
-    return true;
-}
-
-#ifndef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION
-
-/* Use numbered labels and switch statement at the bottom of the match function. */
-
-#define RMATCH_WHERE(num) num
-#define RRETURN_LABEL RRETURN_SWITCH
-
-#else
-
-/* Use GCC's computed goto extension. */
-
-/* For one test case this is more than 40% faster than the switch statement.
-We could avoid the use of the num argument entirely by using local labels,
-but using it for the GCC case as well as the non-GCC case allows us to share
-a bit more code and notice if we use conflicting numbers.*/
-
-#define RMATCH_WHERE(num) &&RRETURN_##num
-#define RRETURN_LABEL *stack.currentFrame->returnLocation
-
-#endif
-
-#define RECURSIVE_MATCH_COMMON(num) \
-    goto RECURSE;\
-    RRETURN_##num: \
-    stack.popCurrentFrame();
-
-#define RECURSIVE_MATCH(num, ra, rb) \
-    do { \
-        stack.pushNewFrame((ra), (rb), RMATCH_WHERE(num)); \
-        RECURSIVE_MATCH_COMMON(num) \
-    } while (0)
-
-#define RECURSIVE_MATCH_NEW_GROUP(num, ra, rb) \
-    do { \
-        stack.pushNewFrame((ra), (rb), RMATCH_WHERE(num)); \
-        startNewGroup(stack.currentFrame); \
-        RECURSIVE_MATCH_COMMON(num) \
-    } while (0)
-
-#define RRETURN goto RRETURN_LABEL
-
-#define RRETURN_NO_MATCH do { isMatch = false; RRETURN; } while (0)
-
-/*************************************************
-*         Match from current position            *
-*************************************************/
-
-/* On entry instructionPtr points to the first opcode, and subjectPtr to the first character
-in the subject string, while substringStart holds the value of subjectPtr at the start of the
-last bracketed group - used for breaking infinite loops matching zero-length
-strings. This function is called recursively in many circumstances. Whenever it
-returns a negative (error) response, the outer match() call must also return the
-same response.
-
-Arguments:
-   subjectPtr        pointer in subject
-   instructionPtr       position in code
-   offsetTop  current top pointer
-   md          pointer to "static" info for the match
-
-Returns:       1 if matched          )  these values are >= 0
-               0 if failed to match  )
-               a negative error value if aborted by an error condition
-                 (e.g. stopped by repeated call or recursion limit)
-*/
-
-static const unsigned numFramesOnStack = 16;
-
-struct MatchStack {
-    MatchStack()
-        : framesEnd(frames + numFramesOnStack)
-        , currentFrame(frames)
-        , size(1) // match() creates accesses the first frame w/o calling pushNewFrame
-    {
-        ASSERT((sizeof(frames) / sizeof(frames[0])) == numFramesOnStack);
-    }
-    
-    MatchFrame frames[numFramesOnStack];
-    MatchFrame* framesEnd;
-    MatchFrame* currentFrame;
-    unsigned size;
-    
-    inline bool canUseStackBufferForNextFrame()
-    {
-        return size < numFramesOnStack;
-    }
-    
-    inline MatchFrame* allocateNextFrame()
-    {
-        if (canUseStackBufferForNextFrame())
-            return currentFrame + 1;
-        return new MatchFrame;
-    }
-    
-    inline void pushNewFrame(const unsigned char* instructionPtr, BracketChainNode* bracketChain, ReturnLocation returnLocation)
-    {
-        MatchFrame* newframe = allocateNextFrame();
-        newframe->previousFrame = currentFrame;
-
-        newframe->args.subjectPtr = currentFrame->args.subjectPtr;
-        newframe->args.offsetTop = currentFrame->args.offsetTop;
-        newframe->args.instructionPtr = instructionPtr;
-        newframe->args.bracketChain = bracketChain;
-        newframe->returnLocation = returnLocation;
-        size++;
-
-        currentFrame = newframe;
-    }
-    
-    inline void popCurrentFrame()
-    {
-        MatchFrame* oldFrame = currentFrame;
-        currentFrame = currentFrame->previousFrame;
-        if (size > numFramesOnStack)
-            delete oldFrame;
-        size--;
-    }
-
-    void popAllFrames()
-    {
-        while (size)
-            popCurrentFrame();
-    }
-};
-
-static int matchError(int errorCode, MatchStack& stack)
-{
-    stack.popAllFrames();
-    return errorCode;
-}
-
-/* Get the next UTF-8 character, not advancing the pointer, incrementing length
- if there are extra bytes. This is called when we know we are in UTF-8 mode. */
-
-static inline void getUTF8CharAndIncrementLength(int& c, const unsigned char* subjectPtr, int& len)
-{
-    c = *subjectPtr;
-    if ((c & 0xc0) == 0xc0) {
-        int gcaa = jsc_pcre_utf8_table4[c & 0x3f];  /* Number of additional bytes */
-        int gcss = 6 * gcaa;
-        c = (c & jsc_pcre_utf8_table3[gcaa]) << gcss;
-        for (int gcii = 1; gcii <= gcaa; gcii++) {
-            gcss -= 6;
-            c |= (subjectPtr[gcii] & 0x3f) << gcss;
-        }
-        len += gcaa;
-    }
-}
-
-static inline void startNewGroup(MatchFrame* currentFrame)
-{
-    /* At the start of a bracketed group, add the current subject pointer to the
-     stack of such pointers, to be re-instated at the end of the group when we hit
-     the closing ket. When match() is called in other circumstances, we don't add to
-     this stack. */
-    
-    currentFrame->locals.bracketChainNode.previousBracket = currentFrame->args.bracketChain;
-    currentFrame->locals.bracketChainNode.bracketStart = currentFrame->args.subjectPtr;
-    currentFrame->args.bracketChain = &currentFrame->locals.bracketChainNode;
-}
-
-// FIXME: "minimize" means "not greedy", we should invert the callers to ask for "greedy" to be less confusing
-static inline void repeatInformationFromInstructionOffset(int instructionOffset, bool& minimize, int& minimumRepeats, int& maximumRepeats)
-{
-    // Instruction offsets are based off of OP_CRSTAR, OP_STAR, OP_TYPESTAR, OP_NOTSTAR
-    static const char minimumRepeatsFromInstructionOffset[] = { 0, 0, 1, 1, 0, 0 };
-    static const int maximumRepeatsFromInstructionOffset[] = { INT_MAX, INT_MAX, INT_MAX, INT_MAX, 1, 1 };
-
-    ASSERT(instructionOffset >= 0);
-    ASSERT(instructionOffset <= (OP_CRMINQUERY - OP_CRSTAR));
-
-    minimize = (instructionOffset & 1); // this assumes ordering: Instruction, MinimizeInstruction, Instruction2, MinimizeInstruction2
-    minimumRepeats = minimumRepeatsFromInstructionOffset[instructionOffset];
-    maximumRepeats = maximumRepeatsFromInstructionOffset[instructionOffset];
-}
-
-static int match(const UChar* subjectPtr, const unsigned char* instructionPtr, int offsetTop, MatchData& md)
-{
-    bool isMatch = false;
-    int min;
-    bool minimize = false; /* Initialization not really needed, but some compilers think so. */
-    unsigned remainingMatchCount = matchLimit;
-    int othercase; /* Declare here to avoid errors during jumps */
-    
-    MatchStack stack;
-
-    /* The opcode jump table. */
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-#define EMIT_JUMP_TABLE_ENTRY(opcode) &&LABEL_OP_##opcode,
-    static void* opcodeJumpTable[256] = { FOR_EACH_OPCODE(EMIT_JUMP_TABLE_ENTRY) };
-#undef EMIT_JUMP_TABLE_ENTRY
-#endif
-    
-    /* One-time setup of the opcode jump table. */
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-    for (int i = 255; !opcodeJumpTable[i]; i--)
-        opcodeJumpTable[i] = &&CAPTURING_BRACKET;
-#endif
-    
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION
-    // Shark shows this as a hot line
-    // Using a static const here makes this line disappear, but makes later access hotter (not sure why)
-    stack.currentFrame->returnLocation = &&RETURN;
-#else
-    stack.currentFrame->returnLocation = 0;
-#endif
-    stack.currentFrame->args.subjectPtr = subjectPtr;
-    stack.currentFrame->args.instructionPtr = instructionPtr;
-    stack.currentFrame->args.offsetTop = offsetTop;
-    stack.currentFrame->args.bracketChain = 0;
-    startNewGroup(stack.currentFrame);
-    
-    /* This is where control jumps back to to effect "recursion" */
-    
-RECURSE:
-    if (!--remainingMatchCount)
-        return matchError(JSRegExpErrorHitLimit, stack);
-
-    /* Now start processing the operations. */
-    
-#ifndef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-    while (true)
-#endif
-    {
-        
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-#define BEGIN_OPCODE(opcode) LABEL_OP_##opcode
-#define NEXT_OPCODE goto *opcodeJumpTable[*stack.currentFrame->args.instructionPtr]
-#else
-#define BEGIN_OPCODE(opcode) case OP_##opcode
-#define NEXT_OPCODE continue
-#endif
-        
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-        NEXT_OPCODE;
-#else
-        switch (*stack.currentFrame->args.instructionPtr)
-#endif
-        {
-            /* Non-capturing bracket: optimized */
-                
-            BEGIN_OPCODE(BRA):
-            NON_CAPTURING_BRACKET:
-                DPRINTF(("start bracket 0\n"));
-                do {
-                    RECURSIVE_MATCH_NEW_GROUP(2, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);
-                    if (isMatch)
-                        RRETURN;
-                    stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);
-                } while (*stack.currentFrame->args.instructionPtr == OP_ALT);
-                DPRINTF(("bracket 0 failed\n"));
-                RRETURN;
-                
-            /* Skip over large extraction number data if encountered. */
-                
-            BEGIN_OPCODE(BRANUMBER):
-                stack.currentFrame->args.instructionPtr += 3;
-                NEXT_OPCODE;
-                
-            /* End of the pattern. */
-                
-            BEGIN_OPCODE(END):
-                md.endMatchPtr = stack.currentFrame->args.subjectPtr;          /* Record where we ended */
-                md.endOffsetTop = stack.currentFrame->args.offsetTop;   /* and how many extracts were taken */
-                isMatch = true;
-                RRETURN;
-                
-            /* Assertion brackets. Check the alternative branches in turn - the
-             matching won't pass the KET for an assertion. If any one branch matches,
-             the assertion is true. Lookbehind assertions have an OP_REVERSE item at the
-             start of each branch to move the current point backwards, so the code at
-             this level is identical to the lookahead case. */
-                
-            BEGIN_OPCODE(ASSERT):
-                do {
-                    RECURSIVE_MATCH_NEW_GROUP(6, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, NULL);
-                    if (isMatch)
-                        break;
-                    stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);
-                } while (*stack.currentFrame->args.instructionPtr == OP_ALT);
-                if (*stack.currentFrame->args.instructionPtr == OP_KET)
-                    RRETURN_NO_MATCH;
-                
-                /* Continue from after the assertion, updating the offsets high water
-                 mark, since extracts may have been taken during the assertion. */
-                
-                advanceToEndOfBracket(stack.currentFrame->args.instructionPtr);
-                stack.currentFrame->args.instructionPtr += 1 + LINK_SIZE;
-                stack.currentFrame->args.offsetTop = md.endOffsetTop;
-                NEXT_OPCODE;
-                
-            /* Negative assertion: all branches must fail to match */
-                
-            BEGIN_OPCODE(ASSERT_NOT):
-                do {
-                    RECURSIVE_MATCH_NEW_GROUP(7, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, NULL);
-                    if (isMatch)
-                        RRETURN_NO_MATCH;
-                    stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);
-                } while (*stack.currentFrame->args.instructionPtr == OP_ALT);
-                
-                stack.currentFrame->args.instructionPtr += 1 + LINK_SIZE;
-                NEXT_OPCODE;
-                
-            /* An alternation is the end of a branch; scan along to find the end of the
-             bracketed group and go to there. */
-                
-            BEGIN_OPCODE(ALT):
-                advanceToEndOfBracket(stack.currentFrame->args.instructionPtr);
-                NEXT_OPCODE;
-                
-            /* BRAZERO and BRAMINZERO occur just before a bracket group, indicating
-             that it may occur zero times. It may repeat infinitely, or not at all -
-             i.e. it could be ()* or ()? in the pattern. Brackets with fixed upper
-             repeat limits are compiled as a number of copies, with the optional ones
-             preceded by BRAZERO or BRAMINZERO. */
-                
-            BEGIN_OPCODE(BRAZERO): {
-                stack.currentFrame->locals.startOfRepeatingBracket = stack.currentFrame->args.instructionPtr + 1;
-                RECURSIVE_MATCH_NEW_GROUP(14, stack.currentFrame->locals.startOfRepeatingBracket, stack.currentFrame->args.bracketChain);
-                if (isMatch)
-                    RRETURN;
-                advanceToEndOfBracket(stack.currentFrame->locals.startOfRepeatingBracket);
-                stack.currentFrame->args.instructionPtr = stack.currentFrame->locals.startOfRepeatingBracket + 1 + LINK_SIZE;
-                NEXT_OPCODE;
-            }
-                
-            BEGIN_OPCODE(BRAMINZERO): {
-                stack.currentFrame->locals.startOfRepeatingBracket = stack.currentFrame->args.instructionPtr + 1;
-                advanceToEndOfBracket(stack.currentFrame->locals.startOfRepeatingBracket);
-                RECURSIVE_MATCH_NEW_GROUP(15, stack.currentFrame->locals.startOfRepeatingBracket + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);
-                if (isMatch)
-                    RRETURN;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-            }
-                
-            /* End of a group, repeated or non-repeating. If we are at the end of
-             an assertion "group", stop matching and return 1, but record the
-             current high water mark for use by positive assertions. Do this also
-             for the "once" (not-backup up) groups. */
-                
-            BEGIN_OPCODE(KET):
-            BEGIN_OPCODE(KETRMIN):
-            BEGIN_OPCODE(KETRMAX):
-                stack.currentFrame->locals.instructionPtrAtStartOfOnce = stack.currentFrame->args.instructionPtr - getLinkValue(stack.currentFrame->args.instructionPtr + 1);
-                stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.bracketChain->bracketStart;
-
-                /* Back up the stack of bracket start pointers. */
-
-                stack.currentFrame->args.bracketChain = stack.currentFrame->args.bracketChain->previousBracket;
-
-                if (*stack.currentFrame->locals.instructionPtrAtStartOfOnce == OP_ASSERT || *stack.currentFrame->locals.instructionPtrAtStartOfOnce == OP_ASSERT_NOT) {
-                    md.endOffsetTop = stack.currentFrame->args.offsetTop;
-                    isMatch = true;
-                    RRETURN;
-                }
-                
-                /* In all other cases except a conditional group we have to check the
-                 group number back at the start and if necessary complete handling an
-                 extraction by setting the offsets and bumping the high water mark. */
-                
-                stack.currentFrame->locals.number = *stack.currentFrame->locals.instructionPtrAtStartOfOnce - OP_BRA;
-                
-                /* For extended extraction brackets (large number), we have to fish out
-                 the number from a dummy opcode at the start. */
-                
-                if (stack.currentFrame->locals.number > EXTRACT_BASIC_MAX)
-                    stack.currentFrame->locals.number = get2ByteValue(stack.currentFrame->locals.instructionPtrAtStartOfOnce + 2 + LINK_SIZE);
-                stack.currentFrame->locals.offset = stack.currentFrame->locals.number << 1;
-                
-#ifdef DEBUG
-                printf("end bracket %d", stack.currentFrame->locals.number);
-                printf("\n");
-#endif
-                
-                /* Test for a numbered group. This includes groups called as a result
-                 of recursion. Note that whole-pattern recursion is coded as a recurse
-                 into group 0, so it won't be picked up here. Instead, we catch it when
-                 the OP_END is reached. */
-                
-                if (stack.currentFrame->locals.number > 0) {
-                    if (stack.currentFrame->locals.offset >= md.offsetMax)
-                        md.offsetOverflow = true;
-                    else {
-                        md.offsetVector[stack.currentFrame->locals.offset] =
-                        md.offsetVector[md.offsetEnd - stack.currentFrame->locals.number];
-                        md.offsetVector[stack.currentFrame->locals.offset+1] = stack.currentFrame->args.subjectPtr - md.startSubject;
-                        if (stack.currentFrame->args.offsetTop <= stack.currentFrame->locals.offset)
-                            stack.currentFrame->args.offsetTop = stack.currentFrame->locals.offset + 2;
-                    }
-                }
-                
-                /* For a non-repeating ket, just continue at this level. This also
-                 happens for a repeating ket if no characters were matched in the group.
-                 This is the forcible breaking of infinite loops as implemented in Perl
-                 5.005. If there is an options reset, it will get obeyed in the normal
-                 course of events. */
-                
-                if (*stack.currentFrame->args.instructionPtr == OP_KET || stack.currentFrame->args.subjectPtr == stack.currentFrame->locals.subjectPtrAtStartOfInstruction) {
-                    stack.currentFrame->args.instructionPtr += 1 + LINK_SIZE;
-                    NEXT_OPCODE;
-                }
-                
-                /* The repeating kets try the rest of the pattern or restart from the
-                 preceding bracket, in the appropriate order. */
-                
-                if (*stack.currentFrame->args.instructionPtr == OP_KETRMIN) {
-                    RECURSIVE_MATCH(16, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);
-                    if (isMatch)
-                        RRETURN;
-                    RECURSIVE_MATCH_NEW_GROUP(17, stack.currentFrame->locals.instructionPtrAtStartOfOnce, stack.currentFrame->args.bracketChain);
-                    if (isMatch)
-                        RRETURN;
-                } else { /* OP_KETRMAX */
-                    RECURSIVE_MATCH_NEW_GROUP(18, stack.currentFrame->locals.instructionPtrAtStartOfOnce, stack.currentFrame->args.bracketChain);
-                    if (isMatch)
-                        RRETURN;
-                    RECURSIVE_MATCH(19, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);
-                    if (isMatch)
-                        RRETURN;
-                }
-                RRETURN;
-                
-            /* Start of subject. */
-
-            BEGIN_OPCODE(CIRC):
-                if (stack.currentFrame->args.subjectPtr != md.startSubject)
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            /* After internal newline if multiline. */
-
-            BEGIN_OPCODE(BOL):
-                if (stack.currentFrame->args.subjectPtr != md.startSubject && !isNewline(stack.currentFrame->args.subjectPtr[-1]))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            /* End of subject. */
-
-            BEGIN_OPCODE(DOLL):
-                if (stack.currentFrame->args.subjectPtr < md.endSubject)
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            /* Before internal newline if multiline. */
-
-            BEGIN_OPCODE(EOL):
-                if (stack.currentFrame->args.subjectPtr < md.endSubject && !isNewline(*stack.currentFrame->args.subjectPtr))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-                
-            /* Word boundary assertions */
-                
-            BEGIN_OPCODE(NOT_WORD_BOUNDARY):
-            BEGIN_OPCODE(WORD_BOUNDARY): {
-                bool currentCharIsWordChar = false;
-                bool previousCharIsWordChar = false;
-                
-                if (stack.currentFrame->args.subjectPtr > md.startSubject)
-                    previousCharIsWordChar = isWordChar(stack.currentFrame->args.subjectPtr[-1]);
-                if (stack.currentFrame->args.subjectPtr < md.endSubject)
-                    currentCharIsWordChar = isWordChar(*stack.currentFrame->args.subjectPtr);
-                
-                /* Now see if the situation is what we want */
-                bool wordBoundaryDesired = (*stack.currentFrame->args.instructionPtr++ == OP_WORD_BOUNDARY);
-                if (wordBoundaryDesired ? currentCharIsWordChar == previousCharIsWordChar : currentCharIsWordChar != previousCharIsWordChar)
-                    RRETURN_NO_MATCH;
-                NEXT_OPCODE;
-            }
-                
-            /* Match a single character type; inline for speed */
-                
-            BEGIN_OPCODE(NOT_NEWLINE):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (isNewline(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            BEGIN_OPCODE(NOT_DIGIT):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (isASCIIDigit(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            BEGIN_OPCODE(DIGIT):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (!isASCIIDigit(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            BEGIN_OPCODE(NOT_WHITESPACE):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (isSpaceChar(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-
-            BEGIN_OPCODE(WHITESPACE):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (!isSpaceChar(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-                
-            BEGIN_OPCODE(NOT_WORDCHAR):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (isWordChar(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-                
-            BEGIN_OPCODE(WORDCHAR):
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (!isWordChar(*stack.currentFrame->args.subjectPtr++))
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr++;
-                NEXT_OPCODE;
-                
-            /* Match a back reference, possibly repeatedly. Look past the end of the
-             item to see if there is repeat information following. The code is similar
-             to that for character classes, but repeated for efficiency. Then obey
-             similar code to character type repeats - written out again for speed.
-             However, if the referenced string is the empty string, always treat
-             it as matched, any number of times (otherwise there could be infinite
-             loops). */
-                
-            BEGIN_OPCODE(REF):
-                stack.currentFrame->locals.offset = get2ByteValue(stack.currentFrame->args.instructionPtr + 1) << 1;               /* Doubled ref number */
-                stack.currentFrame->args.instructionPtr += 3;                                 /* Advance past item */
-                
-                /* If the reference is unset, set the length to be longer than the amount
-                 of subject left; this ensures that every attempt at a match fails. We
-                 can't just fail here, because of the possibility of quantifiers with zero
-                 minima. */
-                
-                if (stack.currentFrame->locals.offset >= stack.currentFrame->args.offsetTop || md.offsetVector[stack.currentFrame->locals.offset] < 0)
-                    stack.currentFrame->locals.length = 0;
-                else
-                    stack.currentFrame->locals.length = md.offsetVector[stack.currentFrame->locals.offset+1] - md.offsetVector[stack.currentFrame->locals.offset];
-                
-                /* Set up for repetition, or handle the non-repeated case */
-                
-                switch (*stack.currentFrame->args.instructionPtr) {
-                    case OP_CRSTAR:
-                    case OP_CRMINSTAR:
-                    case OP_CRPLUS:
-                    case OP_CRMINPLUS:
-                    case OP_CRQUERY:
-                    case OP_CRMINQUERY:
-                        repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_CRSTAR, minimize, min, stack.currentFrame->locals.max);
-                        break;
-                        
-                    case OP_CRRANGE:
-                    case OP_CRMINRANGE:
-                        minimize = (*stack.currentFrame->args.instructionPtr == OP_CRMINRANGE);
-                        min = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                        stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 3);
-                        if (stack.currentFrame->locals.max == 0)
-                            stack.currentFrame->locals.max = INT_MAX;
-                        stack.currentFrame->args.instructionPtr += 5;
-                        break;
-                    
-                    default:               /* No repeat follows */
-                        if (!matchRef(stack.currentFrame->locals.offset, stack.currentFrame->args.subjectPtr, stack.currentFrame->locals.length, md))
-                            RRETURN_NO_MATCH;
-                        stack.currentFrame->args.subjectPtr += stack.currentFrame->locals.length;
-                        NEXT_OPCODE;
-                }
-                
-                /* If the length of the reference is zero, just continue with the
-                 main loop. */
-                
-                if (stack.currentFrame->locals.length == 0)
-                    NEXT_OPCODE;
-                
-                /* First, ensure the minimum number of matches are present. */
-                
-                for (int i = 1; i <= min; i++) {
-                    if (!matchRef(stack.currentFrame->locals.offset, stack.currentFrame->args.subjectPtr, stack.currentFrame->locals.length, md))
-                        RRETURN_NO_MATCH;
-                    stack.currentFrame->args.subjectPtr += stack.currentFrame->locals.length;
-                }
-                
-                /* If min = max, continue at the same level without recursion.
-                 They are not both allowed to be zero. */
-                
-                if (min == stack.currentFrame->locals.max)
-                    NEXT_OPCODE;
-                
-                /* If minimizing, keep trying and advancing the pointer */
-                
-                if (minimize) {
-                    for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                        RECURSIVE_MATCH(20, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || !matchRef(stack.currentFrame->locals.offset, stack.currentFrame->args.subjectPtr, stack.currentFrame->locals.length, md))
-                            RRETURN;
-                        stack.currentFrame->args.subjectPtr += stack.currentFrame->locals.length;
-                    }
-                    /* Control never reaches here */
-                }
-                
-                /* If maximizing, find the longest string and work backwards */
-                
-                else {
-                    stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                    for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                        if (!matchRef(stack.currentFrame->locals.offset, stack.currentFrame->args.subjectPtr, stack.currentFrame->locals.length, md))
-                            break;
-                        stack.currentFrame->args.subjectPtr += stack.currentFrame->locals.length;
-                    }
-                    while (stack.currentFrame->args.subjectPtr >= stack.currentFrame->locals.subjectPtrAtStartOfInstruction) {
-                        RECURSIVE_MATCH(21, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        stack.currentFrame->args.subjectPtr -= stack.currentFrame->locals.length;
-                    }
-                    RRETURN_NO_MATCH;
-                }
-                /* Control never reaches here */
-                
-            /* Match a bit-mapped character class, possibly repeatedly. This op code is
-             used when all the characters in the class have values in the range 0-255,
-             and either the matching is caseful, or the characters are in the range
-             0-127 when UTF-8 processing is enabled. The only difference between
-             OP_CLASS and OP_NCLASS occurs when a data character outside the range is
-             encountered.
-             
-             First, look past the end of the item to see if there is repeat information
-             following. Then obey similar code to character type repeats - written out
-             again for speed. */
-                
-            BEGIN_OPCODE(NCLASS):
-            BEGIN_OPCODE(CLASS):
-                stack.currentFrame->locals.data = stack.currentFrame->args.instructionPtr + 1;                /* Save for matching */
-                stack.currentFrame->args.instructionPtr += 33;                     /* Advance past the item */
-                
-                switch (*stack.currentFrame->args.instructionPtr) {
-                    case OP_CRSTAR:
-                    case OP_CRMINSTAR:
-                    case OP_CRPLUS:
-                    case OP_CRMINPLUS:
-                    case OP_CRQUERY:
-                    case OP_CRMINQUERY:
-                        repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_CRSTAR, minimize, min, stack.currentFrame->locals.max);
-                        break;
-                        
-                    case OP_CRRANGE:
-                    case OP_CRMINRANGE:
-                        minimize = (*stack.currentFrame->args.instructionPtr == OP_CRMINRANGE);
-                        min = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                        stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 3);
-                        if (stack.currentFrame->locals.max == 0)
-                            stack.currentFrame->locals.max = INT_MAX;
-                        stack.currentFrame->args.instructionPtr += 5;
-                        break;
-                        
-                    default:               /* No repeat follows */
-                        min = stack.currentFrame->locals.max = 1;
-                        break;
-                }
-                
-                /* First, ensure the minimum number of matches are present. */
-                
-                for (int i = 1; i <= min; i++) {
-                    if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                        RRETURN_NO_MATCH;
-                    int c = *stack.currentFrame->args.subjectPtr++;
-                    if (c > 255) {
-                        if (stack.currentFrame->locals.data[-1] == OP_CLASS)
-                            RRETURN_NO_MATCH;
-                    } else {
-                        if (!(stack.currentFrame->locals.data[c / 8] & (1 << (c & 7))))
-                            RRETURN_NO_MATCH;
-                    }
-                }
-                
-                /* If max == min we can continue with the main loop without the
-                 need to recurse. */
-                
-                if (min == stack.currentFrame->locals.max)
-                    NEXT_OPCODE;      
-                
-                /* If minimizing, keep testing the rest of the expression and advancing
-                 the pointer while it matches the class. */
-                if (minimize) {
-                    for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                        RECURSIVE_MATCH(22, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject)
-                            RRETURN;
-                        int c = *stack.currentFrame->args.subjectPtr++;
-                        if (c > 255) {
-                            if (stack.currentFrame->locals.data[-1] == OP_CLASS)
-                                RRETURN;
-                        } else {
-                            if ((stack.currentFrame->locals.data[c/8] & (1 << (c&7))) == 0)
-                                RRETURN;
-                        }
-                    }
-                    /* Control never reaches here */
-                }
-                /* If maximizing, find the longest possible run, then work backwards. */
-                else {
-                    stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                    
-                    for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                        if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                            break;
-                        int c = *stack.currentFrame->args.subjectPtr;
-                        if (c > 255) {
-                            if (stack.currentFrame->locals.data[-1] == OP_CLASS)
-                                break;
-                        } else {
-                            if (!(stack.currentFrame->locals.data[c / 8] & (1 << (c & 7))))
-                                break;
-                        }
-                        ++stack.currentFrame->args.subjectPtr;
-                    }
-                    for (;;) {
-                        RECURSIVE_MATCH(24, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->args.subjectPtr-- == stack.currentFrame->locals.subjectPtrAtStartOfInstruction)
-                            break;        /* Stop if tried at original pos */
-                    }
-                    
-                    RRETURN;
-                }
-                /* Control never reaches here */
-                
-            /* Match an extended character class. */
-                
-            BEGIN_OPCODE(XCLASS):
-                stack.currentFrame->locals.data = stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE;                /* Save for matching */
-                stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);                      /* Advance past the item */
-                
-                switch (*stack.currentFrame->args.instructionPtr) {
-                    case OP_CRSTAR:
-                    case OP_CRMINSTAR:
-                    case OP_CRPLUS:
-                    case OP_CRMINPLUS:
-                    case OP_CRQUERY:
-                    case OP_CRMINQUERY:
-                        repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_CRSTAR, minimize, min, stack.currentFrame->locals.max);
-                        break;
-                        
-                    case OP_CRRANGE:
-                    case OP_CRMINRANGE:
-                        minimize = (*stack.currentFrame->args.instructionPtr == OP_CRMINRANGE);
-                        min = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                        stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 3);
-                        if (stack.currentFrame->locals.max == 0)
-                            stack.currentFrame->locals.max = INT_MAX;
-                        stack.currentFrame->args.instructionPtr += 5;
-                        break;
-                        
-                    default:               /* No repeat follows */
-                        min = stack.currentFrame->locals.max = 1;
-                }
-                
-                /* First, ensure the minimum number of matches are present. */
-                
-                for (int i = 1; i <= min; i++) {
-                    if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                        RRETURN_NO_MATCH;
-                    int c = *stack.currentFrame->args.subjectPtr++;
-                    if (!jsc_pcre_xclass(c, stack.currentFrame->locals.data))
-                        RRETURN_NO_MATCH;
-                }
-                
-                /* If max == min we can continue with the main loop without the
-                 need to recurse. */
-                
-                if (min == stack.currentFrame->locals.max)
-                    NEXT_OPCODE;
-                
-                /* If minimizing, keep testing the rest of the expression and advancing
-                 the pointer while it matches the class. */
-                
-                if (minimize) {
-                    for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                        RECURSIVE_MATCH(26, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject)
-                            RRETURN;
-                        int c = *stack.currentFrame->args.subjectPtr++;
-                        if (!jsc_pcre_xclass(c, stack.currentFrame->locals.data))
-                            RRETURN;
-                    }
-                    /* Control never reaches here */
-                }
-                
-                /* If maximizing, find the longest possible run, then work backwards. */
-                
-                else {
-                    stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                    for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                        if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                            break;
-                        int c = *stack.currentFrame->args.subjectPtr;
-                        if (!jsc_pcre_xclass(c, stack.currentFrame->locals.data))
-                            break;
-                        ++stack.currentFrame->args.subjectPtr;
-                    }
-                    for(;;) {
-                        RECURSIVE_MATCH(27, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->args.subjectPtr-- == stack.currentFrame->locals.subjectPtrAtStartOfInstruction)
-                            break;        /* Stop if tried at original pos */
-                    }
-                    RRETURN;
-                }
-                
-                /* Control never reaches here */
-                
-            /* Match a single character, casefully */
-                
-            BEGIN_OPCODE(CHAR):
-                stack.currentFrame->locals.length = 1;
-                stack.currentFrame->args.instructionPtr++;
-                getUTF8CharAndIncrementLength(stack.currentFrame->locals.fc, stack.currentFrame->args.instructionPtr, stack.currentFrame->locals.length);
-                stack.currentFrame->args.instructionPtr += stack.currentFrame->locals.length;
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                if (stack.currentFrame->locals.fc != *stack.currentFrame->args.subjectPtr++)
-                    RRETURN_NO_MATCH;
-                NEXT_OPCODE;
-                
-            /* Match a single character, caselessly */
-                
-            BEGIN_OPCODE(CHAR_IGNORING_CASE): {
-                stack.currentFrame->locals.length = 1;
-                stack.currentFrame->args.instructionPtr++;
-                getUTF8CharAndIncrementLength(stack.currentFrame->locals.fc, stack.currentFrame->args.instructionPtr, stack.currentFrame->locals.length);
-                stack.currentFrame->args.instructionPtr += stack.currentFrame->locals.length;
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                int dc = *stack.currentFrame->args.subjectPtr++;
-                if (stack.currentFrame->locals.fc != dc && jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) != dc)
-                    RRETURN_NO_MATCH;
-                NEXT_OPCODE;
-            }
-                
-            /* Match a single ASCII character. */
-                
-            BEGIN_OPCODE(ASCII_CHAR):
-                if (md.endSubject == stack.currentFrame->args.subjectPtr)
-                    RRETURN_NO_MATCH;
-                if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->args.instructionPtr[1])
-                    RRETURN_NO_MATCH;
-                ++stack.currentFrame->args.subjectPtr;
-                stack.currentFrame->args.instructionPtr += 2;
-                NEXT_OPCODE;
-                
-            /* Match one of two cases of an ASCII letter. */
-                
-            BEGIN_OPCODE(ASCII_LETTER_IGNORING_CASE):
-                if (md.endSubject == stack.currentFrame->args.subjectPtr)
-                    RRETURN_NO_MATCH;
-                if ((*stack.currentFrame->args.subjectPtr | 0x20) != stack.currentFrame->args.instructionPtr[1])
-                    RRETURN_NO_MATCH;
-                ++stack.currentFrame->args.subjectPtr;
-                stack.currentFrame->args.instructionPtr += 2;
-                NEXT_OPCODE;
-                
-            /* Match a single character repeatedly; different opcodes share code. */
-                
-            BEGIN_OPCODE(EXACT):
-                min = stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = false;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATCHAR;
-                
-            BEGIN_OPCODE(UPTO):
-            BEGIN_OPCODE(MINUPTO):
-                min = 0;
-                stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = *stack.currentFrame->args.instructionPtr == OP_MINUPTO;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATCHAR;
-                
-            BEGIN_OPCODE(STAR):
-            BEGIN_OPCODE(MINSTAR):
-            BEGIN_OPCODE(PLUS):
-            BEGIN_OPCODE(MINPLUS):
-            BEGIN_OPCODE(QUERY):
-            BEGIN_OPCODE(MINQUERY):
-                repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_STAR, minimize, min, stack.currentFrame->locals.max);
-                
-                /* Common code for all repeated single-character matches. We can give
-                 up quickly if there are fewer than the minimum number of characters left in
-                 the subject. */
-                
-            REPEATCHAR:
-                
-                stack.currentFrame->locals.length = 1;
-                getUTF8CharAndIncrementLength(stack.currentFrame->locals.fc, stack.currentFrame->args.instructionPtr, stack.currentFrame->locals.length);
-                if (min * (stack.currentFrame->locals.fc > 0xFFFF ? 2 : 1) > md.endSubject - stack.currentFrame->args.subjectPtr)
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->args.instructionPtr += stack.currentFrame->locals.length;
-                
-                if (stack.currentFrame->locals.fc <= 0xFFFF) {
-                    othercase = md.ignoreCase ? jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) : -1;
-                    
-                    for (int i = 1; i <= min; i++) {
-                        if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc && *stack.currentFrame->args.subjectPtr != othercase)
-                            RRETURN_NO_MATCH;
-                        ++stack.currentFrame->args.subjectPtr;
-                    }
-                    
-                    if (min == stack.currentFrame->locals.max)
-                        NEXT_OPCODE;
-                    
-                    if (minimize) {
-                        stack.currentFrame->locals.repeatOthercase = othercase;
-                        for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                            RECURSIVE_MATCH(28, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                RRETURN;
-                            if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc && *stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.repeatOthercase)
-                                RRETURN;
-                            ++stack.currentFrame->args.subjectPtr;
-                        }
-                        /* Control never reaches here */
-                    } else {
-                        stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                        for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                            if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                break;
-                            if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc && *stack.currentFrame->args.subjectPtr != othercase)
-                                break;
-                            ++stack.currentFrame->args.subjectPtr;
-                        }
-                        while (stack.currentFrame->args.subjectPtr >= stack.currentFrame->locals.subjectPtrAtStartOfInstruction) {
-                            RECURSIVE_MATCH(29, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            --stack.currentFrame->args.subjectPtr;
-                        }
-                        RRETURN_NO_MATCH;
-                    }
-                    /* Control never reaches here */
-                } else {
-                    /* No case on surrogate pairs, so no need to bother with "othercase". */
-                    
-                    for (int i = 1; i <= min; i++) {
-                        if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc)
-                            RRETURN_NO_MATCH;
-                        stack.currentFrame->args.subjectPtr += 2;
-                    }
-                    
-                    if (min == stack.currentFrame->locals.max)
-                        NEXT_OPCODE;
-                    
-                    if (minimize) {
-                        for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                            RECURSIVE_MATCH(30, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                RRETURN;
-                            if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc)
-                                RRETURN;
-                            stack.currentFrame->args.subjectPtr += 2;
-                        }
-                        /* Control never reaches here */
-                    } else {
-                        stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                        for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                            if (stack.currentFrame->args.subjectPtr > md.endSubject - 2)
-                                break;
-                            if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc)
-                                break;
-                            stack.currentFrame->args.subjectPtr += 2;
-                        }
-                        while (stack.currentFrame->args.subjectPtr >= stack.currentFrame->locals.subjectPtrAtStartOfInstruction) {
-                            RECURSIVE_MATCH(31, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            stack.currentFrame->args.subjectPtr -= 2;
-                        }
-                        RRETURN_NO_MATCH;
-                    }
-                    /* Control never reaches here */
-                }
-                /* Control never reaches here */
-                
-            /* Match a negated single one-byte character. */
-                
-            BEGIN_OPCODE(NOT): {
-                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                    RRETURN_NO_MATCH;
-                int b = stack.currentFrame->args.instructionPtr[1];
-                int c = *stack.currentFrame->args.subjectPtr++;
-                stack.currentFrame->args.instructionPtr += 2;
-                if (md.ignoreCase) {
-                    if (c < 128)
-                        c = toLowerCase(c);
-                    if (toLowerCase(b) == c)
-                        RRETURN_NO_MATCH;
-                } else {
-                    if (b == c)
-                        RRETURN_NO_MATCH;
-                }
-                NEXT_OPCODE;
-            }
-                
-            /* Match a negated single one-byte character repeatedly. This is almost a
-             repeat of the code for a repeated single character, but I haven't found a
-             nice way of commoning these up that doesn't require a test of the
-             positive/negative option for each character match. Maybe that wouldn't add
-             very much to the time taken, but character matching *is* what this is all
-             about... */
-                
-            BEGIN_OPCODE(NOTEXACT):
-                min = stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = false;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATNOTCHAR;
-                
-            BEGIN_OPCODE(NOTUPTO):
-            BEGIN_OPCODE(NOTMINUPTO):
-                min = 0;
-                stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = *stack.currentFrame->args.instructionPtr == OP_NOTMINUPTO;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATNOTCHAR;
-                
-            BEGIN_OPCODE(NOTSTAR):
-            BEGIN_OPCODE(NOTMINSTAR):
-            BEGIN_OPCODE(NOTPLUS):
-            BEGIN_OPCODE(NOTMINPLUS):
-            BEGIN_OPCODE(NOTQUERY):
-            BEGIN_OPCODE(NOTMINQUERY):
-                repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_NOTSTAR, minimize, min, stack.currentFrame->locals.max);
-                
-            /* Common code for all repeated single-byte matches. We can give up quickly
-             if there are fewer than the minimum number of bytes left in the
-             subject. */
-                
-            REPEATNOTCHAR:
-                if (min > md.endSubject - stack.currentFrame->args.subjectPtr)
-                    RRETURN_NO_MATCH;
-                stack.currentFrame->locals.fc = *stack.currentFrame->args.instructionPtr++;
-                
-                /* The code is duplicated for the caseless and caseful cases, for speed,
-                 since matching characters is likely to be quite common. First, ensure the
-                 minimum number of matches are present. If min = max, continue at the same
-                 level without recursing. Otherwise, if minimizing, keep trying the rest of
-                 the expression and advancing one matching character if failing, up to the
-                 maximum. Alternatively, if maximizing, find the maximum number of
-                 characters and work backwards. */
-                
-                DPRINTF(("negative matching %c{%d,%d}\n", stack.currentFrame->locals.fc, min, stack.currentFrame->locals.max));
-                
-                if (md.ignoreCase) {
-                    if (stack.currentFrame->locals.fc < 128)
-                        stack.currentFrame->locals.fc = toLowerCase(stack.currentFrame->locals.fc);
-                    
-                    for (int i = 1; i <= min; i++) {
-                        int d = *stack.currentFrame->args.subjectPtr++;
-                        if (d < 128)
-                            d = toLowerCase(d);
-                        if (stack.currentFrame->locals.fc == d)
-                            RRETURN_NO_MATCH;
-                    }
-                    
-                    if (min == stack.currentFrame->locals.max)
-                        NEXT_OPCODE;      
-                    
-                    if (minimize) {
-                        for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                            RECURSIVE_MATCH(38, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            int d = *stack.currentFrame->args.subjectPtr++;
-                            if (d < 128)
-                                d = toLowerCase(d);
-                            if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject || stack.currentFrame->locals.fc == d)
-                                RRETURN;
-                        }
-                        /* Control never reaches here */
-                    }
-                    
-                    /* Maximize case */
-                    
-                    else {
-                        stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                        
-                        for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                            if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                break;
-                            int d = *stack.currentFrame->args.subjectPtr;
-                            if (d < 128)
-                                d = toLowerCase(d);
-                            if (stack.currentFrame->locals.fc == d)
-                                break;
-                            ++stack.currentFrame->args.subjectPtr;
-                        }
-                        for (;;) {
-                            RECURSIVE_MATCH(40, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            if (stack.currentFrame->args.subjectPtr-- == stack.currentFrame->locals.subjectPtrAtStartOfInstruction)
-                                break;        /* Stop if tried at original pos */
-                        }
-                        
-                        RRETURN;
-                    }
-                    /* Control never reaches here */
-                }
-                
-                /* Caseful comparisons */
-                
-                else {
-                    for (int i = 1; i <= min; i++) {
-                        int d = *stack.currentFrame->args.subjectPtr++;
-                        if (stack.currentFrame->locals.fc == d)
-                            RRETURN_NO_MATCH;
-                    }
-
-                    if (min == stack.currentFrame->locals.max)
-                        NEXT_OPCODE;
-                    
-                    if (minimize) {
-                        for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                            RECURSIVE_MATCH(42, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            int d = *stack.currentFrame->args.subjectPtr++;
-                            if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject || stack.currentFrame->locals.fc == d)
-                                RRETURN;
-                        }
-                        /* Control never reaches here */
-                    }
-                    
-                    /* Maximize case */
-                    
-                    else {
-                        stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;
-                        
-                        for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                            if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                break;
-                            int d = *stack.currentFrame->args.subjectPtr;
-                            if (stack.currentFrame->locals.fc == d)
-                                break;
-                            ++stack.currentFrame->args.subjectPtr;
-                        }
-                        for (;;) {
-                            RECURSIVE_MATCH(44, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                            if (isMatch)
-                                RRETURN;
-                            if (stack.currentFrame->args.subjectPtr-- == stack.currentFrame->locals.subjectPtrAtStartOfInstruction)
-                                break;        /* Stop if tried at original pos */
-                        }
-
-                        RRETURN;
-                    }
-                }
-                /* Control never reaches here */
-                
-            /* Match a single character type repeatedly; several different opcodes
-             share code. This is very similar to the code for single characters, but we
-             repeat it in the interests of efficiency. */
-                
-            BEGIN_OPCODE(TYPEEXACT):
-                min = stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = true;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATTYPE;
-                
-            BEGIN_OPCODE(TYPEUPTO):
-            BEGIN_OPCODE(TYPEMINUPTO):
-                min = 0;
-                stack.currentFrame->locals.max = get2ByteValue(stack.currentFrame->args.instructionPtr + 1);
-                minimize = *stack.currentFrame->args.instructionPtr == OP_TYPEMINUPTO;
-                stack.currentFrame->args.instructionPtr += 3;
-                goto REPEATTYPE;
-                
-            BEGIN_OPCODE(TYPESTAR):
-            BEGIN_OPCODE(TYPEMINSTAR):
-            BEGIN_OPCODE(TYPEPLUS):
-            BEGIN_OPCODE(TYPEMINPLUS):
-            BEGIN_OPCODE(TYPEQUERY):
-            BEGIN_OPCODE(TYPEMINQUERY):
-                repeatInformationFromInstructionOffset(*stack.currentFrame->args.instructionPtr++ - OP_TYPESTAR, minimize, min, stack.currentFrame->locals.max);
-                
-                /* Common code for all repeated single character type matches. Note that
-                 in UTF-8 mode, '.' matches a character of any length, but for the other
-                 character types, the valid characters are all one-byte long. */
-                
-            REPEATTYPE:
-                stack.currentFrame->locals.ctype = *stack.currentFrame->args.instructionPtr++;      /* Code for the character type */
-                
-                /* First, ensure the minimum number of matches are present. Use inline
-                 code for maximizing the speed, and do the type test once at the start
-                 (i.e. keep it out of the loop). Also we can test that there are at least
-                 the minimum number of characters before we start. */
-                
-                if (min > md.endSubject - stack.currentFrame->args.subjectPtr)
-                    RRETURN_NO_MATCH;
-                if (min > 0) {
-                    switch (stack.currentFrame->locals.ctype) {
-                        case OP_NOT_NEWLINE:
-                            for (int i = 1; i <= min; i++) {
-                                if (isNewline(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_NOT_DIGIT:
-                            for (int i = 1; i <= min; i++) {
-                                if (isASCIIDigit(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_DIGIT:
-                            for (int i = 1; i <= min; i++) {
-                                if (!isASCIIDigit(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_NOT_WHITESPACE:
-                            for (int i = 1; i <= min; i++) {
-                                if (isSpaceChar(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_WHITESPACE:
-                            for (int i = 1; i <= min; i++) {
-                                if (!isSpaceChar(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_NOT_WORDCHAR:
-                            for (int i = 1; i <= min; i++) {
-                                if (isWordChar(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_WORDCHAR:
-                            for (int i = 1; i <= min; i++) {
-                                if (!isWordChar(*stack.currentFrame->args.subjectPtr))
-                                    RRETURN_NO_MATCH;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        default:
-                            ASSERT_NOT_REACHED();
-                            return matchError(JSRegExpErrorInternal, stack);
-                    }  /* End switch(stack.currentFrame->locals.ctype) */
-                }
-                
-                /* If min = max, continue at the same level without recursing */
-                
-                if (min == stack.currentFrame->locals.max)
-                    NEXT_OPCODE;    
-                
-                /* If minimizing, we have to test the rest of the pattern before each
-                 subsequent match. */
-                
-                if (minimize) {
-                    for (stack.currentFrame->locals.fi = min;; stack.currentFrame->locals.fi++) {
-                        RECURSIVE_MATCH(48, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->locals.fi >= stack.currentFrame->locals.max || stack.currentFrame->args.subjectPtr >= md.endSubject)
-                            RRETURN;
-                        
-                        int c = *stack.currentFrame->args.subjectPtr++;
-                        switch (stack.currentFrame->locals.ctype) {
-                            case OP_NOT_NEWLINE:
-                                if (isNewline(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_NOT_DIGIT:
-                                if (isASCIIDigit(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_DIGIT:
-                                if (!isASCIIDigit(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_NOT_WHITESPACE:
-                                if (isSpaceChar(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_WHITESPACE:
-                                if (!isSpaceChar(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_NOT_WORDCHAR:
-                                if (isWordChar(c))
-                                    RRETURN;
-                                break;
-                                
-                            case OP_WORDCHAR:
-                                if (!isWordChar(c))
-                                    RRETURN;
-                                break;
-                                
-                            default:
-                                ASSERT_NOT_REACHED();
-                                return matchError(JSRegExpErrorInternal, stack);
-                        }
-                    }
-                    /* Control never reaches here */
-                }
-                
-                /* If maximizing it is worth using inline code for speed, doing the type
-                 test once at the start (i.e. keep it out of the loop). */
-                
-                else {
-                    stack.currentFrame->locals.subjectPtrAtStartOfInstruction = stack.currentFrame->args.subjectPtr;  /* Remember where we started */
-                    
-                    switch (stack.currentFrame->locals.ctype) {
-                        case OP_NOT_NEWLINE:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject || isNewline(*stack.currentFrame->args.subjectPtr))
-                                    break;
-                                stack.currentFrame->args.subjectPtr++;
-                            }
-                            break;
-                            
-                        case OP_NOT_DIGIT:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (isASCIIDigit(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_DIGIT:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (!isASCIIDigit(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_NOT_WHITESPACE:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (isSpaceChar(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_WHITESPACE:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (!isSpaceChar(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_NOT_WORDCHAR:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (isWordChar(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        case OP_WORDCHAR:
-                            for (int i = min; i < stack.currentFrame->locals.max; i++) {
-                                if (stack.currentFrame->args.subjectPtr >= md.endSubject)
-                                    break;
-                                int c = *stack.currentFrame->args.subjectPtr;
-                                if (!isWordChar(c))
-                                    break;
-                                ++stack.currentFrame->args.subjectPtr;
-                            }
-                            break;
-                            
-                        default:
-                            ASSERT_NOT_REACHED();
-                            return matchError(JSRegExpErrorInternal, stack);
-                    }
-                    
-                    /* stack.currentFrame->args.subjectPtr is now past the end of the maximum run */
-                    
-                    for (;;) {
-                        RECURSIVE_MATCH(52, stack.currentFrame->args.instructionPtr, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        if (stack.currentFrame->args.subjectPtr-- == stack.currentFrame->locals.subjectPtrAtStartOfInstruction)
-                            break;        /* Stop if tried at original pos */
-                    }
-                    
-                    /* Get here if we can't make it match with any permitted repetitions */
-                    
-                    RRETURN;
-                }
-                /* Control never reaches here */
-                
-            BEGIN_OPCODE(CRMINPLUS):
-            BEGIN_OPCODE(CRMINQUERY):
-            BEGIN_OPCODE(CRMINRANGE):
-            BEGIN_OPCODE(CRMINSTAR):
-            BEGIN_OPCODE(CRPLUS):
-            BEGIN_OPCODE(CRQUERY):
-            BEGIN_OPCODE(CRRANGE):
-            BEGIN_OPCODE(CRSTAR):
-                ASSERT_NOT_REACHED();
-                return matchError(JSRegExpErrorInternal, stack);
-                
-#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP
-            CAPTURING_BRACKET:
-#else
-            default:
-#endif
-                /* Opening capturing bracket. If there is space in the offset vector, save
-                 the current subject position in the working slot at the top of the vector. We
-                 mustn't change the current values of the data slot, because they may be set
-                 from a previous iteration of this group, and be referred to by a reference
-                 inside the group.
-                 
-                 If the bracket fails to match, we need to restore this value and also the
-                 values of the final offsets, in case they were set by a previous iteration of
-                 the same bracket.
-                 
-                 If there isn't enough space in the offset vector, treat this as if it were a
-                 non-capturing bracket. Don't worry about setting the flag for the error case
-                 here; that is handled in the code for KET. */
-                
-                ASSERT(*stack.currentFrame->args.instructionPtr > OP_BRA);
-                
-                stack.currentFrame->locals.number = *stack.currentFrame->args.instructionPtr - OP_BRA;
-                
-                /* For extended extraction brackets (large number), we have to fish out the
-                 number from a dummy opcode at the start. */
-                
-                if (stack.currentFrame->locals.number > EXTRACT_BASIC_MAX)
-                    stack.currentFrame->locals.number = get2ByteValue(stack.currentFrame->args.instructionPtr + 2 + LINK_SIZE);
-                stack.currentFrame->locals.offset = stack.currentFrame->locals.number << 1;
-                
-#ifdef DEBUG
-                printf("start bracket %d subject=", stack.currentFrame->locals.number);
-                pchars(stack.currentFrame->args.subjectPtr, 16, true, md);
-                printf("\n");
-#endif
-                
-                if (stack.currentFrame->locals.offset < md.offsetMax) {
-                    stack.currentFrame->locals.saveOffset1 = md.offsetVector[stack.currentFrame->locals.offset];
-                    stack.currentFrame->locals.saveOffset2 = md.offsetVector[stack.currentFrame->locals.offset + 1];
-                    stack.currentFrame->locals.saveOffset3 = md.offsetVector[md.offsetEnd - stack.currentFrame->locals.number];
-                    
-                    DPRINTF(("saving %d %d %d\n", stack.currentFrame->locals.saveOffset1, stack.currentFrame->locals.saveOffset2, stack.currentFrame->locals.saveOffset3));
-                    md.offsetVector[md.offsetEnd - stack.currentFrame->locals.number] = stack.currentFrame->args.subjectPtr - md.startSubject;
-                    
-                    do {
-                        RECURSIVE_MATCH_NEW_GROUP(1, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);
-                        if (isMatch)
-                            RRETURN;
-                        stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);
-                    } while (*stack.currentFrame->args.instructionPtr == OP_ALT);
-                    
-                    DPRINTF(("bracket %d failed\n", stack.currentFrame->locals.number));
-                    
-                    md.offsetVector[stack.currentFrame->locals.offset] = stack.currentFrame->locals.saveOffset1;
-                    md.offsetVector[stack.currentFrame->locals.offset + 1] = stack.currentFrame->locals.saveOffset2;
-                    md.offsetVector[md.offsetEnd - stack.currentFrame->locals.number] = stack.currentFrame->locals.saveOffset3;
-                    
-                    RRETURN;
-                }
-                
-                /* Insufficient room for saving captured contents */
-                
-                goto NON_CAPTURING_BRACKET;
-        }
-        
-        /* Do not stick any code in here without much thought; it is assumed
-         that "continue" in the code above comes out to here to repeat the main
-         loop. */
-        
-    } /* End of main loop */
-    
-    ASSERT_NOT_REACHED();
-    
-#ifndef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION
-    
-RRETURN_SWITCH:
-    switch (stack.currentFrame->returnLocation) {
-        case 0: goto RETURN;
-        case 1: goto RRETURN_1;
-        case 2: goto RRETURN_2;
-        case 6: goto RRETURN_6;
-        case 7: goto RRETURN_7;
-        case 14: goto RRETURN_14;
-        case 15: goto RRETURN_15;
-        case 16: goto RRETURN_16;
-        case 17: goto RRETURN_17;
-        case 18: goto RRETURN_18;
-        case 19: goto RRETURN_19;
-        case 20: goto RRETURN_20;
-        case 21: goto RRETURN_21;
-        case 22: goto RRETURN_22;
-        case 24: goto RRETURN_24;
-        case 26: goto RRETURN_26;
-        case 27: goto RRETURN_27;
-        case 28: goto RRETURN_28;
-        case 29: goto RRETURN_29;
-        case 30: goto RRETURN_30;
-        case 31: goto RRETURN_31;
-        case 38: goto RRETURN_38;
-        case 40: goto RRETURN_40;
-        case 42: goto RRETURN_42;
-        case 44: goto RRETURN_44;
-        case 48: goto RRETURN_48;
-        case 52: goto RRETURN_52;
-    }
-    
-    ASSERT_NOT_REACHED();
-    return matchError(JSRegExpErrorInternal, stack);
-    
-#endif
-    
-RETURN:
-    return isMatch;
-}
-
-
-/*************************************************
-*         Execute a Regular Expression           *
-*************************************************/
-
-/* This function applies a compiled re to a subject string and picks out
-portions of the string if it matches. Two elements in the vector are set for
-each substring: the offsets to the start and end of the substring.
-
-Arguments:
-  re              points to the compiled expression
-  extra_data      points to extra data or is NULL
-  subject         points to the subject string
-  length          length of subject string (may contain binary zeros)
-  start_offset    where to start in the subject string
-  options         option bits
-  offsets         points to a vector of ints to be filled in with offsets
-  offsetCount     the number of elements in the vector
-
-Returns:          > 0 => success; value is the number of elements filled in
-                  = 0 => success, but offsets is not big enough
-                   -1 => failed to match
-                 < -1 => some kind of unexpected problem
-*/
-
-static void tryFirstByteOptimization(const UChar*& subjectPtr, const UChar* endSubject, int firstByte, bool firstByteIsCaseless, bool useMultiLineFirstCharOptimization, const UChar* originalSubjectStart)
-{
-    // If firstByte is set, try scanning to the first instance of that byte
-    // no need to try and match against any earlier part of the subject string.
-    if (firstByte >= 0) {
-        UChar firstChar = firstByte;
-        if (firstByteIsCaseless)
-            while (subjectPtr < endSubject) {
-                int c = *subjectPtr;
-                if (c > 127)
-                    break;
-                if (toLowerCase(c) == firstChar)
-                    break;
-                subjectPtr++;
-            }
-        else {
-            while (subjectPtr < endSubject && *subjectPtr != firstChar)
-                subjectPtr++;
-        }
-    } else if (useMultiLineFirstCharOptimization) {
-        /* Or to just after \n for a multiline match if possible */
-        // I'm not sure why this != originalSubjectStart check is necessary -- ecs 11/18/07
-        if (subjectPtr > originalSubjectStart) {
-            while (subjectPtr < endSubject && !isNewline(subjectPtr[-1]))
-                subjectPtr++;
-        }
-    }
-}
-
-static bool tryRequiredByteOptimization(const UChar*& subjectPtr, const UChar* endSubject, int reqByte, int reqByte2, bool reqByteIsCaseless, bool hasFirstByte, const UChar*& reqBytePtr)
-{
-    /* If reqByte is set, we know that that character must appear in the subject
-     for the match to succeed. If the first character is set, reqByte must be
-     later in the subject; otherwise the test starts at the match point. This
-     optimization can save a huge amount of backtracking in patterns with nested
-     unlimited repeats that aren't going to match. Writing separate code for
-     cased/caseless versions makes it go faster, as does using an autoincrement
-     and backing off on a match.
-     
-     HOWEVER: when the subject string is very, very long, searching to its end can
-     take a long time, and give bad performance on quite ordinary patterns. This
-     showed up when somebody was matching /^C/ on a 32-megabyte string... so we
-     don't do this when the string is sufficiently long.
-    */
-
-    if (reqByte >= 0 && endSubject - subjectPtr < REQ_BYTE_MAX) {
-        const UChar* p = subjectPtr + (hasFirstByte ? 1 : 0);
-
-        /* We don't need to repeat the search if we haven't yet reached the
-         place we found it at last time. */
-
-        if (p > reqBytePtr) {
-            if (reqByteIsCaseless) {
-                while (p < endSubject) {
-                    int pp = *p++;
-                    if (pp == reqByte || pp == reqByte2) {
-                        p--;
-                        break;
-                    }
-                }
-            } else {
-                while (p < endSubject) {
-                    if (*p++ == reqByte) {
-                        p--;
-                        break;
-                    }
-                }
-            }
-
-            /* If we can't find the required character, break the matching loop */
-
-            if (p >= endSubject)
-                return true;
-
-            /* If we have found the required character, save the point where we
-             found it, so that we don't search again next time round the loop if
-             the start hasn't passed this character yet. */
-
-            reqBytePtr = p;
-        }
-    }
-    return false;
-}
-
-int jsRegExpExecute(const JSRegExp* re,
-                    const UChar* subject, int length, int start_offset, int* offsets,
-                    int offsetCount)
-{
-    ASSERT(re);
-    ASSERT(subject || !length);
-    ASSERT(offsetCount >= 0);
-    ASSERT(offsets || offsetCount == 0);
-
-    HistogramTimeLogger logger(re);
-
-    MatchData matchBlock;
-    matchBlock.startSubject = subject;
-    matchBlock.endSubject = matchBlock.startSubject + length;
-    const UChar* endSubject = matchBlock.endSubject;
-    
-    matchBlock.multiline = (re->options & MatchAcrossMultipleLinesOption);
-    matchBlock.ignoreCase = (re->options & IgnoreCaseOption);
-    
-    /* If the expression has got more back references than the offsets supplied can
-     hold, we get a temporary chunk of working store to use during the matching.
-     Otherwise, we can use the vector supplied, rounding down its size to a multiple
-     of 3. */
-    
-    int ocount = offsetCount - (offsetCount % 3);
-    
-    // FIXME: This is lame that we have to second-guess our caller here.
-    // The API should change to either fail-hard when we don't have enough offset space
-    // or that we shouldn't ask our callers to pre-allocate in the first place.
-    bool usingTemporaryOffsets = false;
-    if (re->topBackref > 0 && re->topBackref >= ocount/3) {
-        ocount = re->topBackref * 3 + 3;
-        matchBlock.offsetVector = new int[ocount];
-        if (!matchBlock.offsetVector)
-            return JSRegExpErrorNoMemory;
-        usingTemporaryOffsets = true;
-    } else
-        matchBlock.offsetVector = offsets;
-    
-    matchBlock.offsetEnd = ocount;
-    matchBlock.offsetMax = (2*ocount)/3;
-    matchBlock.offsetOverflow = false;
-    
-    /* Compute the minimum number of offsets that we need to reset each time. Doing
-     this makes a huge difference to execution time when there aren't many brackets
-     in the pattern. */
-    
-    int resetCount = 2 + re->topBracket * 2;
-    if (resetCount > offsetCount)
-        resetCount = ocount;
-    
-    /* Reset the working variable associated with each extraction. These should
-     never be used unless previously set, but they get saved and restored, and so we
-     initialize them to avoid reading uninitialized locations. */
-    
-    if (matchBlock.offsetVector) {
-        int* iptr = matchBlock.offsetVector + ocount;
-        int* iend = iptr - resetCount/2 + 1;
-        while (--iptr >= iend)
-            *iptr = -1;
-    }
-    
-    /* Set up the first character to match, if available. The firstByte value is
-     never set for an anchored regular expression, but the anchoring may be forced
-     at run time, so we have to test for anchoring. The first char may be unset for
-     an unanchored pattern, of course. If there's no first char and the pattern was
-     studied, there may be a bitmap of possible first characters. */
-    
-    bool firstByteIsCaseless = false;
-    int firstByte = -1;
-    if (re->options & UseFirstByteOptimizationOption) {
-        firstByte = re->firstByte & 255;
-        if ((firstByteIsCaseless = (re->firstByte & REQ_IGNORE_CASE)))
-            firstByte = toLowerCase(firstByte);
-    }
-    
-    /* For anchored or unanchored matches, there may be a "last known required
-     character" set. */
-    
-    bool reqByteIsCaseless = false;
-    int reqByte = -1;
-    int reqByte2 = -1;
-    if (re->options & UseRequiredByteOptimizationOption) {
-        reqByte = re->reqByte & 255; // FIXME: This optimization could be made to work for UTF16 chars as well...
-        reqByteIsCaseless = (re->reqByte & REQ_IGNORE_CASE);
-        reqByte2 = flipCase(reqByte);
-    }
-    
-    /* Loop for handling unanchored repeated matching attempts; for anchored regexs
-     the loop runs just once. */
-    
-    const UChar* startMatch = subject + start_offset;
-    const UChar* reqBytePtr = startMatch - 1;
-    bool useMultiLineFirstCharOptimization = re->options & UseMultiLineFirstByteOptimizationOption;
-    
-    do {
-        /* Reset the maximum number of extractions we might see. */
-        if (matchBlock.offsetVector) {
-            int* iptr = matchBlock.offsetVector;
-            int* iend = iptr + resetCount;
-            while (iptr < iend)
-                *iptr++ = -1;
-        }
-        
-        tryFirstByteOptimization(startMatch, endSubject, firstByte, firstByteIsCaseless, useMultiLineFirstCharOptimization, matchBlock.startSubject + start_offset);
-        if (tryRequiredByteOptimization(startMatch, endSubject, reqByte, reqByte2, reqByteIsCaseless, firstByte >= 0, reqBytePtr))
-            break;
-                
-        /* When a match occurs, substrings will be set for all internal extractions;
-         we just need to set up the whole thing as substring 0 before returning. If
-         there were too many extractions, set the return code to zero. In the case
-         where we had to get some local store to hold offsets for backreferences, copy
-         those back references that we can. In this case there need not be overflow
-         if certain parts of the pattern were not used. */
-        
-        /* The code starts after the JSRegExp block and the capture name table. */
-        const unsigned char* start_code = (const unsigned char*)(re + 1);
-        
-        int returnCode = match(startMatch, start_code, 2, matchBlock);
-        
-        /* When the result is no match, advance the pointer to the next character
-         and continue. */
-        if (returnCode == 0) {
-            startMatch++;
-            continue;
-        }
-
-        if (returnCode != 1) {
-            ASSERT(returnCode == JSRegExpErrorHitLimit || returnCode == JSRegExpErrorNoMemory);
-            DPRINTF((">>>> error: returning %d\n", returnCode));
-            return returnCode;
-        }
-        
-        /* We have a match! Copy the offset information from temporary store if
-         necessary */
-        
-        if (usingTemporaryOffsets) {
-            if (offsetCount >= 4) {
-                memcpy(offsets + 2, matchBlock.offsetVector + 2, (offsetCount - 2) * sizeof(int));
-                DPRINTF(("Copied offsets from temporary memory\n"));
-            }
-            if (matchBlock.endOffsetTop > offsetCount)
-                matchBlock.offsetOverflow = true;
-            
-            DPRINTF(("Freeing temporary memory\n"));
-            delete [] matchBlock.offsetVector;
-        }
-        
-        returnCode = matchBlock.offsetOverflow ? 0 : matchBlock.endOffsetTop / 2;
-        
-        if (offsetCount < 2)
-            returnCode = 0;
-        else {
-            offsets[0] = startMatch - matchBlock.startSubject;
-            offsets[1] = matchBlock.endMatchPtr - matchBlock.startSubject;
-        }
-        
-        DPRINTF((">>>> returning %d\n", returnCode));
-        return returnCode;
-    } while (!(re->options & IsAnchoredOption) && startMatch <= endSubject);
-    
-    if (usingTemporaryOffsets) {
-        DPRINTF(("Freeing temporary memory\n"));
-        delete [] matchBlock.offsetVector;
-    }
-    
-    DPRINTF((">>>> returning PCRE_ERROR_NOMATCH\n"));
-    return JSRegExpErrorNoMatch;
-}
-
-#if REGEXP_HISTOGRAM
-
-class CompareHistogramEntries {
-public:
-    bool operator()(const pair<UString, double>& a, const pair<UString, double>& b)
-    {
-        if (a.second == b.second)
-            return a.first < b.first;
-        return a.second < b.second;
-    }
-};
-
-Histogram::~Histogram()
-{
-    Vector<pair<UString, double> > values;
-    Map::iterator end = times.end();
-    for (Map::iterator it = times.begin(); it != end; ++it)
-        values.append(*it);
-    sort(values.begin(), values.end(), CompareHistogramEntries());
-    size_t size = values.size();
-    printf("Regular Expressions, sorted by time spent evaluating them:\n");
-    for (size_t i = 0; i < size; ++i)
-        printf("    %f - %s\n", values[size - i - 1].second, values[size - i - 1].first.utf8().c_str());
-}
-
-void Histogram::add(const JSRegExp* re, double elapsedTime)
-{
-    UString string(reinterpret_cast<const UChar*>(reinterpret_cast<const char*>(re) + re->stringOffset), re->stringLength);
-    if (re->options & IgnoreCaseOption && re->options & MatchAcrossMultipleLinesOption)
-        string += " (multi-line, ignore case)";
-    else {
-        if (re->options & IgnoreCaseOption)
-            string += " (ignore case)";
-        if (re->options & MatchAcrossMultipleLinesOption)
-            string += " (multi-line)";
-    }
-    pair<Map::iterator, bool> result = times.add(string.impl(), elapsedTime);
-    if (!result.second)
-        result.first->second += elapsedTime;
-}
-
-HistogramTimeLogger::HistogramTimeLogger(const JSRegExp* re)
-    : m_re(re)
-    , m_startTime(currentTimeMS())
-{
-}
-
-HistogramTimeLogger::~HistogramTimeLogger()
-{
-    static Histogram histogram;
-    histogram.add(m_re, currentTimeMS() - m_startTime);
-}
-
-#endif
diff --git a/Source/JavaScriptCore/pcre/pcre_internal.h b/Source/JavaScriptCore/pcre/pcre_internal.h
deleted file mode 100644
index 0016bb5..0000000
--- a/Source/JavaScriptCore/pcre/pcre_internal.h
+++ /dev/null
@@ -1,455 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/* This header contains definitions that are shared between the different
-modules, but which are not relevant to the exported API. This includes some
-functions whose names all begin with "_pcre_". */
-
-#ifndef PCRE_INTERNAL_H
-#define PCRE_INTERNAL_H
-
-/* Bit definitions for entries in the pcre_ctypes table. */
-
-#define ctype_space   0x01
-#define ctype_xdigit  0x08
-#define ctype_word    0x10   /* alphameric or '_' */
-
-/* Offsets for the bitmap tables in pcre_cbits. Each table contains a set
-of bits for a class map. Some classes are built by combining these tables. */
-
-#define cbit_space     0      /* \s */
-#define cbit_digit    32      /* \d */
-#define cbit_word     64      /* \w */
-#define cbit_length   96      /* Length of the cbits table */
-
-/* Offsets of the various tables from the base tables pointer, and
-total length. */
-
-#define lcc_offset      0
-#define fcc_offset    128
-#define cbits_offset  256
-#define ctypes_offset (cbits_offset + cbit_length)
-#define tables_length (ctypes_offset + 128)
-
-#ifndef DFTABLES
-
-// Change the following to 1 to dump used regular expressions at process exit time.
-#define REGEXP_HISTOGRAM 0
-
-#include "Assertions.h"
-
-#if COMPILER(MSVC)
-#pragma warning(disable: 4232)
-#pragma warning(disable: 4244)
-#endif
-
-#include "pcre.h"
-
-/* The value of LINK_SIZE determines the number of bytes used to store links as
-offsets within the compiled regex. The default is 2, which allows for compiled
-patterns up to 64K long. */
-
-#define LINK_SIZE   3
-
-/* Define DEBUG to get debugging output on stdout. */
-
-#if 0
-#define DEBUG
-#endif
-
-/* Use a macro for debugging printing, 'cause that eliminates the use of #ifdef
-inline, and there are *still* stupid compilers about that don't like indented
-pre-processor statements, or at least there were when I first wrote this. After
-all, it had only been about 10 years then... */
-
-#ifdef DEBUG
-#define DPRINTF(p) printf p
-#else
-#define DPRINTF(p) /*nothing*/
-#endif
-
-/* PCRE keeps offsets in its compiled code as 2-byte quantities (always stored
-in big-endian order) by default. These are used, for example, to link from the
-start of a subpattern to its alternatives and its end. The use of 2 bytes per
-offset limits the size of the compiled regex to around 64K, which is big enough
-for almost everybody. However, I received a request for an even bigger limit.
-For this reason, and also to make the code easier to maintain, the storing and
-loading of offsets from the byte string is now handled by the functions that are
-defined here. */
-
-/* PCRE uses some other 2-byte quantities that do not change when the size of
-offsets changes. There are used for repeat counts and for other things such as
-capturing parenthesis numbers in back references. */
-
-static inline void put2ByteValue(unsigned char* opcodePtr, int value)
-{
-    ASSERT(value >= 0 && value <= 0xFFFF);
-    opcodePtr[0] = value >> 8;
-    opcodePtr[1] = value;
-}
-
-static inline void put3ByteValue(unsigned char* opcodePtr, int value)
-{
-    ASSERT(value >= 0 && value <= 0xFFFFFF);
-    opcodePtr[0] = value >> 16;
-    opcodePtr[1] = value >> 8;
-    opcodePtr[2] = value;
-}
-
-static inline int get2ByteValue(const unsigned char* opcodePtr)
-{
-    return (opcodePtr[0] << 8) | opcodePtr[1];
-}
-
-static inline int get3ByteValue(const unsigned char* opcodePtr)
-{
-    return (opcodePtr[0] << 16) | (opcodePtr[1] << 8) | opcodePtr[2];
-}
-
-static inline void put2ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
-{
-    put2ByteValue(opcodePtr, value);
-    opcodePtr += 2;
-}
-
-static inline void put3ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
-{
-    put3ByteValue(opcodePtr, value);
-    opcodePtr += 3;
-}
-
-static inline void putLinkValueAllowZero(unsigned char* opcodePtr, int value)
-{
-#if LINK_SIZE == 3
-    put3ByteValue(opcodePtr, value);
-#elif LINK_SIZE == 2
-    put2ByteValue(opcodePtr, value);
-#else
-#   error LINK_SIZE not supported.
-#endif
-}
-
-static inline int getLinkValueAllowZero(const unsigned char* opcodePtr)
-{
-#if LINK_SIZE == 3
-    return get3ByteValue(opcodePtr);
-#elif LINK_SIZE == 2
-    return get2ByteValue(opcodePtr);
-#else
-#   error LINK_SIZE not supported.
-#endif
-}
-
-#define MAX_PATTERN_SIZE 1024 * 1024 // Derived by empirical testing of compile time in PCRE and WREC.
-COMPILE_ASSERT(MAX_PATTERN_SIZE < (1 << (8 * LINK_SIZE)), pcre_max_pattern_fits_in_bytecode);
-
-static inline void putLinkValue(unsigned char* opcodePtr, int value)
-{
-    ASSERT(value);
-    putLinkValueAllowZero(opcodePtr, value);
-}
-
-static inline int getLinkValue(const unsigned char* opcodePtr)
-{
-    int value = getLinkValueAllowZero(opcodePtr);
-    ASSERT(value);
-    return value;
-}
-
-static inline void putLinkValueAndAdvance(unsigned char*& opcodePtr, int value)
-{
-    putLinkValue(opcodePtr, value);
-    opcodePtr += LINK_SIZE;
-}
-
-static inline void putLinkValueAllowZeroAndAdvance(unsigned char*& opcodePtr, int value)
-{
-    putLinkValueAllowZero(opcodePtr, value);
-    opcodePtr += LINK_SIZE;
-}
-
-// FIXME: These are really more of a "compiled regexp state" than "regexp options"
-enum RegExpOptions {
-    UseFirstByteOptimizationOption = 0x40000000,  /* firstByte is set */
-    UseRequiredByteOptimizationOption = 0x20000000,  /* reqByte is set */
-    UseMultiLineFirstByteOptimizationOption = 0x10000000,  /* start after \n for multiline */
-    IsAnchoredOption = 0x02000000,  /* can't use partial with this regex */
-    IgnoreCaseOption = 0x00000001,
-    MatchAcrossMultipleLinesOption = 0x00000002
-};
-
-/* Flags added to firstByte or reqByte; a "non-literal" item is either a
-variable-length repeat, or a anything other than literal characters. */
-
-#define REQ_IGNORE_CASE 0x0100    /* indicates should ignore case */
-#define REQ_VARY     0x0200    /* reqByte followed non-literal item */
-
-/* Miscellaneous definitions */
-
-/* Flag bits and data types for the extended class (OP_XCLASS) for classes that
-contain UTF-8 characters with values greater than 255. */
-
-#define XCL_NOT    0x01    /* Flag: this is a negative class */
-#define XCL_MAP    0x02    /* Flag: a 32-byte map is present */
-
-#define XCL_END       0    /* Marks end of individual items */
-#define XCL_SINGLE    1    /* Single item (one multibyte char) follows */
-#define XCL_RANGE     2    /* A range (two multibyte chars) follows */
-
-/* These are escaped items that aren't just an encoding of a particular data
-value such as \n. They must have non-zero values, as check_escape() returns
-their negation. Also, they must appear in the same order as in the opcode
-definitions below, up to ESC_w. The final one must be
-ESC_REF as subsequent values are used for \1, \2, \3, etc. There is are two
-tests in the code for an escape > ESC_b and <= ESC_w to
-detect the types that may be repeated. These are the types that consume
-characters. If any new escapes are put in between that don't consume a
-character, that code will have to change. */
-
-enum { ESC_B = 1, ESC_b, ESC_D, ESC_d, ESC_S, ESC_s, ESC_W, ESC_w, ESC_REF };
-
-/* Opcode table: OP_BRA must be last, as all values >= it are used for brackets
-that extract substrings. Starting from 1 (i.e. after OP_END), the values up to
-OP_EOD must correspond in order to the list of escapes immediately above.
-Note that whenever this list is updated, the two macro definitions that follow
-must also be updated to match. */
-
-#define FOR_EACH_OPCODE(macro) \
-    macro(END) \
-    \
-    macro(NOT_WORD_BOUNDARY) \
-    macro(WORD_BOUNDARY) \
-    macro(NOT_DIGIT) \
-    macro(DIGIT) \
-    macro(NOT_WHITESPACE) \
-    macro(WHITESPACE) \
-    macro(NOT_WORDCHAR) \
-    macro(WORDCHAR) \
-    \
-    macro(NOT_NEWLINE) \
-    \
-    macro(CIRC) \
-    macro(DOLL) \
-    macro(BOL) \
-    macro(EOL) \
-    macro(CHAR) \
-    macro(CHAR_IGNORING_CASE) \
-    macro(ASCII_CHAR) \
-    macro(ASCII_LETTER_IGNORING_CASE) \
-    macro(NOT) \
-    \
-    macro(STAR) \
-    macro(MINSTAR) \
-    macro(PLUS) \
-    macro(MINPLUS) \
-    macro(QUERY) \
-    macro(MINQUERY) \
-    macro(UPTO) \
-    macro(MINUPTO) \
-    macro(EXACT) \
-    \
-    macro(NOTSTAR) \
-    macro(NOTMINSTAR) \
-    macro(NOTPLUS) \
-    macro(NOTMINPLUS) \
-    macro(NOTQUERY) \
-    macro(NOTMINQUERY) \
-    macro(NOTUPTO) \
-    macro(NOTMINUPTO) \
-    macro(NOTEXACT) \
-    \
-    macro(TYPESTAR) \
-    macro(TYPEMINSTAR) \
-    macro(TYPEPLUS) \
-    macro(TYPEMINPLUS) \
-    macro(TYPEQUERY) \
-    macro(TYPEMINQUERY) \
-    macro(TYPEUPTO) \
-    macro(TYPEMINUPTO) \
-    macro(TYPEEXACT) \
-    \
-    macro(CRSTAR) \
-    macro(CRMINSTAR) \
-    macro(CRPLUS) \
-    macro(CRMINPLUS) \
-    macro(CRQUERY) \
-    macro(CRMINQUERY) \
-    macro(CRRANGE) \
-    macro(CRMINRANGE) \
-    \
-    macro(CLASS) \
-    macro(NCLASS) \
-    macro(XCLASS) \
-    \
-    macro(REF) \
-    \
-    macro(ALT) \
-    macro(KET) \
-    macro(KETRMAX) \
-    macro(KETRMIN) \
-    \
-    macro(ASSERT) \
-    macro(ASSERT_NOT) \
-    \
-    macro(BRAZERO) \
-    macro(BRAMINZERO) \
-    macro(BRANUMBER) \
-    macro(BRA)
-
-#define OPCODE_ENUM_VALUE(opcode) OP_##opcode,
-enum { FOR_EACH_OPCODE(OPCODE_ENUM_VALUE) };
-
-/* WARNING WARNING WARNING: There is an implicit assumption in pcre.c and
-study.c that all opcodes are less than 128 in value. This makes handling UTF-8
-character sequences easier. */
-
-/* The highest extraction number before we have to start using additional
-bytes. (Originally PCRE didn't have support for extraction counts higher than
-this number.) The value is limited by the number of opcodes left after OP_BRA,
-i.e. 255 - OP_BRA. We actually set it a bit lower to leave room for additional
-opcodes. */
-
-/* FIXME: Note that OP_BRA + 100 is > 128, so the two comments above
-are in conflict! */
-
-#define EXTRACT_BASIC_MAX  100
-
-/* The code vector runs on as long as necessary after the end. */
-
-struct JSRegExp {
-    unsigned options;
-
-    unsigned short topBracket;
-    unsigned short topBackref;
-    
-    unsigned short firstByte;
-    unsigned short reqByte;
-
-#if REGEXP_HISTOGRAM
-    size_t stringOffset;
-    size_t stringLength;
-#endif
-};
-
-/* Internal shared data tables. These are tables that are used by more than one
- of the exported public functions. They have to be "external" in the C sense,
- but are not part of the PCRE public API. The data for these tables is in the
- pcre_tables.c module. */
-
-#define jsc_pcre_utf8_table1_size 6
-
-extern const int    jsc_pcre_utf8_table1[6];
-extern const int    jsc_pcre_utf8_table2[6];
-extern const int    jsc_pcre_utf8_table3[6];
-extern const unsigned char jsc_pcre_utf8_table4[0x40];
-
-extern const unsigned char jsc_pcre_default_tables[tables_length];
-
-static inline unsigned char toLowerCase(unsigned char c)
-{
-    static const unsigned char* lowerCaseChars = jsc_pcre_default_tables + lcc_offset;
-    return lowerCaseChars[c];
-}
-
-static inline unsigned char flipCase(unsigned char c)
-{
-    static const unsigned char* flippedCaseChars = jsc_pcre_default_tables + fcc_offset;
-    return flippedCaseChars[c];
-}
-
-static inline unsigned char classBitmapForChar(unsigned char c)
-{
-    static const unsigned char* charClassBitmaps = jsc_pcre_default_tables + cbits_offset;
-    return charClassBitmaps[c];
-}
-
-static inline unsigned char charTypeForChar(unsigned char c)
-{
-    const unsigned char* charTypeMap = jsc_pcre_default_tables + ctypes_offset;
-    return charTypeMap[c];
-}
-
-static inline bool isWordChar(UChar c)
-{
-    return c < 128 && (charTypeForChar(c) & ctype_word);
-}
-
-static inline bool isSpaceChar(UChar c)
-{
-    return (c < 128 && (charTypeForChar(c) & ctype_space)) || c == 0x00A0;
-}
-
-static inline bool isNewline(UChar nl)
-{
-    return (nl == 0xA || nl == 0xD || nl == 0x2028 || nl == 0x2029);
-}
-
-static inline bool isBracketStartOpcode(unsigned char opcode)
-{
-    if (opcode >= OP_BRA)
-        return true;
-    switch (opcode) {
-        case OP_ASSERT:
-        case OP_ASSERT_NOT:
-            return true;
-        default:
-            return false;
-    }
-}
-
-static inline void advanceToEndOfBracket(const unsigned char*& opcodePtr)
-{
-    ASSERT(isBracketStartOpcode(*opcodePtr) || *opcodePtr == OP_ALT);
-    do
-        opcodePtr += getLinkValue(opcodePtr + 1);
-    while (*opcodePtr == OP_ALT);
-}
-
-/* Internal shared functions. These are functions that are used in more
-that one of the source files. They have to have external linkage, but
-but are not part of the public API and so not exported from the library. */
-
-extern int jsc_pcre_ucp_othercase(unsigned);
-extern bool jsc_pcre_xclass(int, const unsigned char*);
-
-#endif
-
-#endif
-
-/* End of pcre_internal.h */
diff --git a/Source/JavaScriptCore/pcre/pcre_tables.cpp b/Source/JavaScriptCore/pcre/pcre_tables.cpp
deleted file mode 100644
index 8696879..0000000
--- a/Source/JavaScriptCore/pcre/pcre_tables.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/* This module contains some fixed tables that are used by more than one of the
-PCRE code modules. */
-
-#include "config.h"
-#include "pcre_internal.h"
-
-/*************************************************
-*           Tables for UTF-8 support             *
-*************************************************/
-
-/* These are the breakpoints for different numbers of bytes in a UTF-8
-character. */
-
-const int jsc_pcre_utf8_table1[6] =
-  { 0x7f, 0x7ff, 0xffff, 0x1fffff, 0x3ffffff, 0x7fffffff};
-
-/* These are the indicator bits and the mask for the data bits to set in the
-first byte of a character, indexed by the number of additional bytes. */
-
-const int jsc_pcre_utf8_table2[6] = { 0,    0xc0, 0xe0, 0xf0, 0xf8, 0xfc};
-const int jsc_pcre_utf8_table3[6] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
-
-/* Table of the number of extra characters, indexed by the first character
-masked with 0x3f. The highest number for a valid UTF-8 character is in fact
-0x3d. */
-
-const unsigned char jsc_pcre_utf8_table4[0x40] = {
-  1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
-  1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
-  2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
-  3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
-
-#include "chartables.c"
diff --git a/Source/JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp b/Source/JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp
deleted file mode 100644
index d2052b2..0000000
--- a/Source/JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp
+++ /dev/null
@@ -1,99 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-
-/* This module contains code for searching the table of Unicode character
-properties. */
-
-#include "config.h"
-#include "pcre_internal.h"
-
-#include "ucpinternal.h"       /* Internal table details */
-#include "ucptable.cpp"        /* The table itself */
-
-/*************************************************
-*       Search table and return other case       *
-*************************************************/
-
-/* If the given character is a letter, and there is another case for the
-letter, return the other case. Otherwise, return -1.
-
-Arguments:
-  c           the character value
-
-Returns:      the other case or -1 if none
-*/
-
-int jsc_pcre_ucp_othercase(unsigned c)
-{
-    int bot = 0;
-    int top = sizeof(ucp_table) / sizeof(cnode);
-    int mid;
-    
-    /* The table is searched using a binary chop. You might think that using
-     intermediate variables to hold some of the common expressions would speed
-     things up, but tests with gcc 3.4.4 on Linux showed that, on the contrary, it
-     makes things a lot slower. */
-    
-    for (;;) {
-        if (top <= bot)
-            return -1;
-        mid = (bot + top) >> 1;
-        if (c == (ucp_table[mid].f0 & f0_charmask))
-            break;
-        if (c < (ucp_table[mid].f0 & f0_charmask))
-            top = mid;
-        else {
-            if ((ucp_table[mid].f0 & f0_rangeflag) && (c <= (ucp_table[mid].f0 & f0_charmask) + (ucp_table[mid].f1 & f1_rangemask)))
-                break;
-            bot = mid + 1;
-        }
-    }
-    
-    /* Found an entry in the table. Return -1 for a range entry. Otherwise return
-     the other case if there is one, else -1. */
-    
-    if (ucp_table[mid].f0 & f0_rangeflag)
-        return -1;
-    
-    int offset = ucp_table[mid].f1 & f1_casemask;
-    if (offset & f1_caseneg)
-        offset |= f1_caseneg;
-    return !offset ? -1 : static_cast<int>(c + offset);
-}
diff --git a/Source/JavaScriptCore/pcre/pcre_xclass.cpp b/Source/JavaScriptCore/pcre/pcre_xclass.cpp
deleted file mode 100644
index a32edd4..0000000
--- a/Source/JavaScriptCore/pcre/pcre_xclass.cpp
+++ /dev/null
@@ -1,115 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/* This module contains an internal function that is used to match an extended
-class (one that contains characters whose values are > 255). */
-
-#include "config.h"
-#include "pcre_internal.h"
-
-/*************************************************
-*       Match character against an XCLASS        *
-*************************************************/
-
-/* This function is called to match a character against an extended class that
-might contain values > 255.
-
-Arguments:
-  c           the character
-  data        points to the flag byte of the XCLASS data
-
-Returns:      true if character matches, else false
-*/
-
-/* Get the next UTF-8 character, advancing the pointer. This is called when we
- know we are in UTF-8 mode. */
-
-static inline void getUTF8CharAndAdvancePointer(int& c, const unsigned char*& subjectPtr)
-{
-    c = *subjectPtr++;
-    if ((c & 0xc0) == 0xc0) {
-        int gcaa = jsc_pcre_utf8_table4[c & 0x3f];  /* Number of additional bytes */
-        int gcss = 6 * gcaa;
-        c = (c & jsc_pcre_utf8_table3[gcaa]) << gcss;
-        while (gcaa-- > 0) {
-            gcss -= 6;
-            c |= (*subjectPtr++ & 0x3f) << gcss;
-        }
-    }
-}
-
-bool jsc_pcre_xclass(int c, const unsigned char* data)
-{
-    bool negated = (*data & XCL_NOT);
-    
-    /* Character values < 256 are matched against a bitmap, if one is present. If
-     not, we still carry on, because there may be ranges that start below 256 in the
-     additional data. */
-    
-    if (c < 256) {
-        if ((*data & XCL_MAP) != 0 && (data[1 + c/8] & (1 << (c&7))) != 0)
-            return !negated;   /* char found */
-    }
-    
-    /* First skip the bit map if present. Then match against the list of Unicode
-     properties or large chars or ranges that end with a large char. We won't ever
-     encounter XCL_PROP or XCL_NOTPROP when UCP support is not compiled. */
-    
-    if ((*data++ & XCL_MAP) != 0)
-        data += 32;
-    
-    int t;
-    while ((t = *data++) != XCL_END) {
-        if (t == XCL_SINGLE) {
-            int x;
-            getUTF8CharAndAdvancePointer(x, data);
-            if (c == x)
-                return !negated;
-        }
-        else if (t == XCL_RANGE) {
-            int x, y;
-            getUTF8CharAndAdvancePointer(x, data);
-            getUTF8CharAndAdvancePointer(y, data);
-            if (c >= x && c <= y)
-                return !negated;
-        }
-    }
-    
-    return negated;   /* char did not match */
-}
diff --git a/Source/JavaScriptCore/pcre/ucpinternal.h b/Source/JavaScriptCore/pcre/ucpinternal.h
deleted file mode 100644
index c8bc4aa..0000000
--- a/Source/JavaScriptCore/pcre/ucpinternal.h
+++ /dev/null
@@ -1,126 +0,0 @@
-/* This is JavaScriptCore's variant of the PCRE library. While this library
-started out as a copy of PCRE, many of the features of PCRE have been
-removed. This library now supports only the regular expression features
-required by the JavaScript language specification, and has only the functions
-needed by JavaScriptCore and the rest of WebKit.
-
-                 Originally written by Philip Hazel
-           Copyright (c) 1997-2006 University of Cambridge
-    Copyright (C) 2002, 2004, 2006, 2007 Apple Inc. All rights reserved.
-
------------------------------------------------------------------------------
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright notice,
-      this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-
-    * Neither the name of the University of Cambridge nor the names of its
-      contributors may be used to endorse or promote products derived from
-      this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
------------------------------------------------------------------------------
-*/
-
-/*************************************************
-*           Unicode Property Table handler       *
-*************************************************/
-
-/* Internal header file defining the layout of the bits in each pair of 32-bit
-words that form a data item in the table. */
-
-typedef struct cnode {
-  unsigned f0;
-  unsigned f1;
-} cnode;
-
-/* Things for the f0 field */
-
-#define f0_scriptmask   0xff000000  /* Mask for script field */
-#define f0_scriptshift          24  /* Shift for script value */
-#define f0_rangeflag    0x00f00000  /* Flag for a range item */
-#define f0_charmask     0x001fffff  /* Mask for code point value */
-
-/* Things for the f1 field */
-
-#define f1_typemask     0xfc000000  /* Mask for char type field */
-#define f1_typeshift            26  /* Shift for the type field */
-#define f1_rangemask    0x0000ffff  /* Mask for a range offset */
-#define f1_casemask     0x0000ffff  /* Mask for a case offset */
-#define f1_caseneg      0xffff8000  /* Bits for negation */
-
-/* The data consists of a vector of structures of type cnode. The two unsigned
-32-bit integers are used as follows:
-
-(f0) (1) The most significant byte holds the script number. The numbers are
-         defined by the enum in ucp.h.
-
-     (2) The 0x00800000 bit is set if this entry defines a range of characters.
-         It is not set if this entry defines a single character
-
-     (3) The 0x00600000 bits are spare.
-
-     (4) The 0x001fffff bits contain the code point. No Unicode code point will
-         ever be greater than 0x0010ffff, so this should be OK for ever.
-
-(f1) (1) The 0xfc000000 bits contain the character type number. The numbers are
-         defined by an enum in ucp.h.
-
-     (2) The 0x03ff0000 bits are spare.
-
-     (3) The 0x0000ffff bits contain EITHER the unsigned offset to the top of
-         range if this entry defines a range, OR the *signed* offset to the
-         character's "other case" partner if this entry defines a single
-         character. There is no partner if the value is zero.
-
--------------------------------------------------------------------------------
-| script (8) |.|.|.| codepoint (21) || type (6) |.|.| spare (8) | offset (16) |
--------------------------------------------------------------------------------
-              | | |                              | |
-              | | |-> spare                      | |-> spare
-              | |                                |
-              | |-> spare                        |-> spare
-              |
-              |-> range flag
-
-The upper/lower casing information is set only for characters that come in
-pairs. The non-one-to-one mappings in the Unicode data are ignored.
-
-When searching the data, proceed as follows:
-
-(1) Set up for a binary chop search.
-
-(2) If the top is not greater than the bottom, the character is not in the
-    table. Its type must therefore be "Cn" ("Undefined").
-
-(3) Find the middle vector element.
-
-(4) Extract the code point and compare. If equal, we are done.
-
-(5) If the test character is smaller, set the top to the current point, and
-    goto (2).
-
-(6) If the current entry defines a range, compute the last character by adding
-    the offset, and see if the test character is within the range. If it is,
-    we are done.
-
-(7) Otherwise, set the bottom to one element past the current point and goto
-    (2).
-*/
-
-/* End of ucpinternal.h */
diff --git a/Source/JavaScriptCore/pcre/ucptable.cpp b/Source/JavaScriptCore/pcre/ucptable.cpp
deleted file mode 100644
index 011f7f5..0000000
--- a/Source/JavaScriptCore/pcre/ucptable.cpp
+++ /dev/null
@@ -1,2968 +0,0 @@
-/* This source module is automatically generated from the Unicode
-property table. See ucpinternal.h for a description of the layout. */
-
-static const cnode ucp_table[] = {
-  { 0x09800000, 0x0000001f },
-  { 0x09000020, 0x74000000 },
-  { 0x09800021, 0x54000002 },
-  { 0x09000024, 0x5c000000 },
-  { 0x09800025, 0x54000002 },
-  { 0x09000028, 0x58000000 },
-  { 0x09000029, 0x48000000 },
-  { 0x0900002a, 0x54000000 },
-  { 0x0900002b, 0x64000000 },
-  { 0x0900002c, 0x54000000 },
-  { 0x0900002d, 0x44000000 },
-  { 0x0980002e, 0x54000001 },
-  { 0x09800030, 0x34000009 },
-  { 0x0980003a, 0x54000001 },
-  { 0x0980003c, 0x64000002 },
-  { 0x0980003f, 0x54000001 },
-  { 0x21000041, 0x24000020 },
-  { 0x21000042, 0x24000020 },
-  { 0x21000043, 0x24000020 },
-  { 0x21000044, 0x24000020 },
-  { 0x21000045, 0x24000020 },
-  { 0x21000046, 0x24000020 },
-  { 0x21000047, 0x24000020 },
-  { 0x21000048, 0x24000020 },
-  { 0x21000049, 0x24000020 },
-  { 0x2100004a, 0x24000020 },
-  { 0x2100004b, 0x24000020 },
-  { 0x2100004c, 0x24000020 },
-  { 0x2100004d, 0x24000020 },
-  { 0x2100004e, 0x24000020 },
-  { 0x2100004f, 0x24000020 },
-  { 0x21000050, 0x24000020 },
-  { 0x21000051, 0x24000020 },
-  { 0x21000052, 0x24000020 },
-  { 0x21000053, 0x24000020 },
-  { 0x21000054, 0x24000020 },
-  { 0x21000055, 0x24000020 },
-  { 0x21000056, 0x24000020 },
-  { 0x21000057, 0x24000020 },
-  { 0x21000058, 0x24000020 },
-  { 0x21000059, 0x24000020 },
-  { 0x2100005a, 0x24000020 },
-  { 0x0900005b, 0x58000000 },
-  { 0x0900005c, 0x54000000 },
-  { 0x0900005d, 0x48000000 },
-  { 0x0900005e, 0x60000000 },
-  { 0x0900005f, 0x40000000 },
-  { 0x09000060, 0x60000000 },
-  { 0x21000061, 0x1400ffe0 },
-  { 0x21000062, 0x1400ffe0 },
-  { 0x21000063, 0x1400ffe0 },
-  { 0x21000064, 0x1400ffe0 },
-  { 0x21000065, 0x1400ffe0 },
-  { 0x21000066, 0x1400ffe0 },
-  { 0x21000067, 0x1400ffe0 },
-  { 0x21000068, 0x1400ffe0 },
-  { 0x21000069, 0x1400ffe0 },
-  { 0x2100006a, 0x1400ffe0 },
-  { 0x2100006b, 0x1400ffe0 },
-  { 0x2100006c, 0x1400ffe0 },
-  { 0x2100006d, 0x1400ffe0 },
-  { 0x2100006e, 0x1400ffe0 },
-  { 0x2100006f, 0x1400ffe0 },
-  { 0x21000070, 0x1400ffe0 },
-  { 0x21000071, 0x1400ffe0 },
-  { 0x21000072, 0x1400ffe0 },
-  { 0x21000073, 0x1400ffe0 },
-  { 0x21000074, 0x1400ffe0 },
-  { 0x21000075, 0x1400ffe0 },
-  { 0x21000076, 0x1400ffe0 },
-  { 0x21000077, 0x1400ffe0 },
-  { 0x21000078, 0x1400ffe0 },
-  { 0x21000079, 0x1400ffe0 },
-  { 0x2100007a, 0x1400ffe0 },
-  { 0x0900007b, 0x58000000 },
-  { 0x0900007c, 0x64000000 },
-  { 0x0900007d, 0x48000000 },
-  { 0x0900007e, 0x64000000 },
-  { 0x0980007f, 0x00000020 },
-  { 0x090000a0, 0x74000000 },
-  { 0x090000a1, 0x54000000 },
-  { 0x098000a2, 0x5c000003 },
-  { 0x098000a6, 0x68000001 },
-  { 0x090000a8, 0x60000000 },
-  { 0x090000a9, 0x68000000 },
-  { 0x210000aa, 0x14000000 },
-  { 0x090000ab, 0x50000000 },
-  { 0x090000ac, 0x64000000 },
-  { 0x090000ad, 0x04000000 },
-  { 0x090000ae, 0x68000000 },
-  { 0x090000af, 0x60000000 },
-  { 0x090000b0, 0x68000000 },
-  { 0x090000b1, 0x64000000 },
-  { 0x098000b2, 0x3c000001 },
-  { 0x090000b4, 0x60000000 },
-  { 0x090000b5, 0x140002e7 },
-  { 0x090000b6, 0x68000000 },
-  { 0x090000b7, 0x54000000 },
-  { 0x090000b8, 0x60000000 },
-  { 0x090000b9, 0x3c000000 },
-  { 0x210000ba, 0x14000000 },
-  { 0x090000bb, 0x4c000000 },
-  { 0x098000bc, 0x3c000002 },
-  { 0x090000bf, 0x54000000 },
-  { 0x210000c0, 0x24000020 },
-  { 0x210000c1, 0x24000020 },
-  { 0x210000c2, 0x24000020 },
-  { 0x210000c3, 0x24000020 },
-  { 0x210000c4, 0x24000020 },
-  { 0x210000c5, 0x24000020 },
-  { 0x210000c6, 0x24000020 },
-  { 0x210000c7, 0x24000020 },
-  { 0x210000c8, 0x24000020 },
-  { 0x210000c9, 0x24000020 },
-  { 0x210000ca, 0x24000020 },
-  { 0x210000cb, 0x24000020 },
-  { 0x210000cc, 0x24000020 },
-  { 0x210000cd, 0x24000020 },
-  { 0x210000ce, 0x24000020 },
-  { 0x210000cf, 0x24000020 },
-  { 0x210000d0, 0x24000020 },
-  { 0x210000d1, 0x24000020 },
-  { 0x210000d2, 0x24000020 },
-  { 0x210000d3, 0x24000020 },
-  { 0x210000d4, 0x24000020 },
-  { 0x210000d5, 0x24000020 },
-  { 0x210000d6, 0x24000020 },
-  { 0x090000d7, 0x64000000 },
-  { 0x210000d8, 0x24000020 },
-  { 0x210000d9, 0x24000020 },
-  { 0x210000da, 0x24000020 },
-  { 0x210000db, 0x24000020 },
-  { 0x210000dc, 0x24000020 },
-  { 0x210000dd, 0x24000020 },
-  { 0x210000de, 0x24000020 },
-  { 0x210000df, 0x14000000 },
-  { 0x210000e0, 0x1400ffe0 },
-  { 0x210000e1, 0x1400ffe0 },
-  { 0x210000e2, 0x1400ffe0 },
-  { 0x210000e3, 0x1400ffe0 },
-  { 0x210000e4, 0x1400ffe0 },
-  { 0x210000e5, 0x1400ffe0 },
-  { 0x210000e6, 0x1400ffe0 },
-  { 0x210000e7, 0x1400ffe0 },
-  { 0x210000e8, 0x1400ffe0 },
-  { 0x210000e9, 0x1400ffe0 },
-  { 0x210000ea, 0x1400ffe0 },
-  { 0x210000eb, 0x1400ffe0 },
-  { 0x210000ec, 0x1400ffe0 },
-  { 0x210000ed, 0x1400ffe0 },
-  { 0x210000ee, 0x1400ffe0 },
-  { 0x210000ef, 0x1400ffe0 },
-  { 0x210000f0, 0x1400ffe0 },
-  { 0x210000f1, 0x1400ffe0 },
-  { 0x210000f2, 0x1400ffe0 },
-  { 0x210000f3, 0x1400ffe0 },
-  { 0x210000f4, 0x1400ffe0 },
-  { 0x210000f5, 0x1400ffe0 },
-  { 0x210000f6, 0x1400ffe0 },
-  { 0x090000f7, 0x64000000 },
-  { 0x210000f8, 0x1400ffe0 },
-  { 0x210000f9, 0x1400ffe0 },
-  { 0x210000fa, 0x1400ffe0 },
-  { 0x210000fb, 0x1400ffe0 },
-  { 0x210000fc, 0x1400ffe0 },
-  { 0x210000fd, 0x1400ffe0 },
-  { 0x210000fe, 0x1400ffe0 },
-  { 0x210000ff, 0x14000079 },
-  { 0x21000100, 0x24000001 },
-  { 0x21000101, 0x1400ffff },
-  { 0x21000102, 0x24000001 },
-  { 0x21000103, 0x1400ffff },
-  { 0x21000104, 0x24000001 },
-  { 0x21000105, 0x1400ffff },
-  { 0x21000106, 0x24000001 },
-  { 0x21000107, 0x1400ffff },
-  { 0x21000108, 0x24000001 },
-  { 0x21000109, 0x1400ffff },
-  { 0x2100010a, 0x24000001 },
-  { 0x2100010b, 0x1400ffff },
-  { 0x2100010c, 0x24000001 },
-  { 0x2100010d, 0x1400ffff },
-  { 0x2100010e, 0x24000001 },
-  { 0x2100010f, 0x1400ffff },
-  { 0x21000110, 0x24000001 },
-  { 0x21000111, 0x1400ffff },
-  { 0x21000112, 0x24000001 },
-  { 0x21000113, 0x1400ffff },
-  { 0x21000114, 0x24000001 },
-  { 0x21000115, 0x1400ffff },
-  { 0x21000116, 0x24000001 },
-  { 0x21000117, 0x1400ffff },
-  { 0x21000118, 0x24000001 },
-  { 0x21000119, 0x1400ffff },
-  { 0x2100011a, 0x24000001 },
-  { 0x2100011b, 0x1400ffff },
-  { 0x2100011c, 0x24000001 },
-  { 0x2100011d, 0x1400ffff },
-  { 0x2100011e, 0x24000001 },
-  { 0x2100011f, 0x1400ffff },
-  { 0x21000120, 0x24000001 },
-  { 0x21000121, 0x1400ffff },
-  { 0x21000122, 0x24000001 },
-  { 0x21000123, 0x1400ffff },
-  { 0x21000124, 0x24000001 },
-  { 0x21000125, 0x1400ffff },
-  { 0x21000126, 0x24000001 },
-  { 0x21000127, 0x1400ffff },
-  { 0x21000128, 0x24000001 },
-  { 0x21000129, 0x1400ffff },
-  { 0x2100012a, 0x24000001 },
-  { 0x2100012b, 0x1400ffff },
-  { 0x2100012c, 0x24000001 },
-  { 0x2100012d, 0x1400ffff },
-  { 0x2100012e, 0x24000001 },
-  { 0x2100012f, 0x1400ffff },
-  { 0x21000130, 0x2400ff39 },
-  { 0x21000131, 0x1400ff18 },
-  { 0x21000132, 0x24000001 },
-  { 0x21000133, 0x1400ffff },
-  { 0x21000134, 0x24000001 },
-  { 0x21000135, 0x1400ffff },
-  { 0x21000136, 0x24000001 },
-  { 0x21000137, 0x1400ffff },
-  { 0x21000138, 0x14000000 },
-  { 0x21000139, 0x24000001 },
-  { 0x2100013a, 0x1400ffff },
-  { 0x2100013b, 0x24000001 },
-  { 0x2100013c, 0x1400ffff },
-  { 0x2100013d, 0x24000001 },
-  { 0x2100013e, 0x1400ffff },
-  { 0x2100013f, 0x24000001 },
-  { 0x21000140, 0x1400ffff },
-  { 0x21000141, 0x24000001 },
-  { 0x21000142, 0x1400ffff },
-  { 0x21000143, 0x24000001 },
-  { 0x21000144, 0x1400ffff },
-  { 0x21000145, 0x24000001 },
-  { 0x21000146, 0x1400ffff },
-  { 0x21000147, 0x24000001 },
-  { 0x21000148, 0x1400ffff },
-  { 0x21000149, 0x14000000 },
-  { 0x2100014a, 0x24000001 },
-  { 0x2100014b, 0x1400ffff },
-  { 0x2100014c, 0x24000001 },
-  { 0x2100014d, 0x1400ffff },
-  { 0x2100014e, 0x24000001 },
-  { 0x2100014f, 0x1400ffff },
-  { 0x21000150, 0x24000001 },
-  { 0x21000151, 0x1400ffff },
-  { 0x21000152, 0x24000001 },
-  { 0x21000153, 0x1400ffff },
-  { 0x21000154, 0x24000001 },
-  { 0x21000155, 0x1400ffff },
-  { 0x21000156, 0x24000001 },
-  { 0x21000157, 0x1400ffff },
-  { 0x21000158, 0x24000001 },
-  { 0x21000159, 0x1400ffff },
-  { 0x2100015a, 0x24000001 },
-  { 0x2100015b, 0x1400ffff },
-  { 0x2100015c, 0x24000001 },
-  { 0x2100015d, 0x1400ffff },
-  { 0x2100015e, 0x24000001 },
-  { 0x2100015f, 0x1400ffff },
-  { 0x21000160, 0x24000001 },
-  { 0x21000161, 0x1400ffff },
-  { 0x21000162, 0x24000001 },
-  { 0x21000163, 0x1400ffff },
-  { 0x21000164, 0x24000001 },
-  { 0x21000165, 0x1400ffff },
-  { 0x21000166, 0x24000001 },
-  { 0x21000167, 0x1400ffff },
-  { 0x21000168, 0x24000001 },
-  { 0x21000169, 0x1400ffff },
-  { 0x2100016a, 0x24000001 },
-  { 0x2100016b, 0x1400ffff },
-  { 0x2100016c, 0x24000001 },
-  { 0x2100016d, 0x1400ffff },
-  { 0x2100016e, 0x24000001 },
-  { 0x2100016f, 0x1400ffff },
-  { 0x21000170, 0x24000001 },
-  { 0x21000171, 0x1400ffff },
-  { 0x21000172, 0x24000001 },
-  { 0x21000173, 0x1400ffff },
-  { 0x21000174, 0x24000001 },
-  { 0x21000175, 0x1400ffff },
-  { 0x21000176, 0x24000001 },
-  { 0x21000177, 0x1400ffff },
-  { 0x21000178, 0x2400ff87 },
-  { 0x21000179, 0x24000001 },
-  { 0x2100017a, 0x1400ffff },
-  { 0x2100017b, 0x24000001 },
-  { 0x2100017c, 0x1400ffff },
-  { 0x2100017d, 0x24000001 },
-  { 0x2100017e, 0x1400ffff },
-  { 0x2100017f, 0x1400fed4 },
-  { 0x21000180, 0x14000000 },
-  { 0x21000181, 0x240000d2 },
-  { 0x21000182, 0x24000001 },
-  { 0x21000183, 0x1400ffff },
-  { 0x21000184, 0x24000001 },
-  { 0x21000185, 0x1400ffff },
-  { 0x21000186, 0x240000ce },
-  { 0x21000187, 0x24000001 },
-  { 0x21000188, 0x1400ffff },
-  { 0x21000189, 0x240000cd },
-  { 0x2100018a, 0x240000cd },
-  { 0x2100018b, 0x24000001 },
-  { 0x2100018c, 0x1400ffff },
-  { 0x2100018d, 0x14000000 },
-  { 0x2100018e, 0x2400004f },
-  { 0x2100018f, 0x240000ca },
-  { 0x21000190, 0x240000cb },
-  { 0x21000191, 0x24000001 },
-  { 0x21000192, 0x1400ffff },
-  { 0x21000193, 0x240000cd },
-  { 0x21000194, 0x240000cf },
-  { 0x21000195, 0x14000061 },
-  { 0x21000196, 0x240000d3 },
-  { 0x21000197, 0x240000d1 },
-  { 0x21000198, 0x24000001 },
-  { 0x21000199, 0x1400ffff },
-  { 0x2100019a, 0x140000a3 },
-  { 0x2100019b, 0x14000000 },
-  { 0x2100019c, 0x240000d3 },
-  { 0x2100019d, 0x240000d5 },
-  { 0x2100019e, 0x14000082 },
-  { 0x2100019f, 0x240000d6 },
-  { 0x210001a0, 0x24000001 },
-  { 0x210001a1, 0x1400ffff },
-  { 0x210001a2, 0x24000001 },
-  { 0x210001a3, 0x1400ffff },
-  { 0x210001a4, 0x24000001 },
-  { 0x210001a5, 0x1400ffff },
-  { 0x210001a6, 0x240000da },
-  { 0x210001a7, 0x24000001 },
-  { 0x210001a8, 0x1400ffff },
-  { 0x210001a9, 0x240000da },
-  { 0x218001aa, 0x14000001 },
-  { 0x210001ac, 0x24000001 },
-  { 0x210001ad, 0x1400ffff },
-  { 0x210001ae, 0x240000da },
-  { 0x210001af, 0x24000001 },
-  { 0x210001b0, 0x1400ffff },
-  { 0x210001b1, 0x240000d9 },
-  { 0x210001b2, 0x240000d9 },
-  { 0x210001b3, 0x24000001 },
-  { 0x210001b4, 0x1400ffff },
-  { 0x210001b5, 0x24000001 },
-  { 0x210001b6, 0x1400ffff },
-  { 0x210001b7, 0x240000db },
-  { 0x210001b8, 0x24000001 },
-  { 0x210001b9, 0x1400ffff },
-  { 0x210001ba, 0x14000000 },
-  { 0x210001bb, 0x1c000000 },
-  { 0x210001bc, 0x24000001 },
-  { 0x210001bd, 0x1400ffff },
-  { 0x210001be, 0x14000000 },
-  { 0x210001bf, 0x14000038 },
-  { 0x218001c0, 0x1c000003 },
-  { 0x210001c4, 0x24000002 },
-  { 0x210001c5, 0x2000ffff },
-  { 0x210001c6, 0x1400fffe },
-  { 0x210001c7, 0x24000002 },
-  { 0x210001c8, 0x2000ffff },
-  { 0x210001c9, 0x1400fffe },
-  { 0x210001ca, 0x24000002 },
-  { 0x210001cb, 0x2000ffff },
-  { 0x210001cc, 0x1400fffe },
-  { 0x210001cd, 0x24000001 },
-  { 0x210001ce, 0x1400ffff },
-  { 0x210001cf, 0x24000001 },
-  { 0x210001d0, 0x1400ffff },
-  { 0x210001d1, 0x24000001 },
-  { 0x210001d2, 0x1400ffff },
-  { 0x210001d3, 0x24000001 },
-  { 0x210001d4, 0x1400ffff },
-  { 0x210001d5, 0x24000001 },
-  { 0x210001d6, 0x1400ffff },
-  { 0x210001d7, 0x24000001 },
-  { 0x210001d8, 0x1400ffff },
-  { 0x210001d9, 0x24000001 },
-  { 0x210001da, 0x1400ffff },
-  { 0x210001db, 0x24000001 },
-  { 0x210001dc, 0x1400ffff },
-  { 0x210001dd, 0x1400ffb1 },
-  { 0x210001de, 0x24000001 },
-  { 0x210001df, 0x1400ffff },
-  { 0x210001e0, 0x24000001 },
-  { 0x210001e1, 0x1400ffff },
-  { 0x210001e2, 0x24000001 },
-  { 0x210001e3, 0x1400ffff },
-  { 0x210001e4, 0x24000001 },
-  { 0x210001e5, 0x1400ffff },
-  { 0x210001e6, 0x24000001 },
-  { 0x210001e7, 0x1400ffff },
-  { 0x210001e8, 0x24000001 },
-  { 0x210001e9, 0x1400ffff },
-  { 0x210001ea, 0x24000001 },
-  { 0x210001eb, 0x1400ffff },
-  { 0x210001ec, 0x24000001 },
-  { 0x210001ed, 0x1400ffff },
-  { 0x210001ee, 0x24000001 },
-  { 0x210001ef, 0x1400ffff },
-  { 0x210001f0, 0x14000000 },
-  { 0x210001f1, 0x24000002 },
-  { 0x210001f2, 0x2000ffff },
-  { 0x210001f3, 0x1400fffe },
-  { 0x210001f4, 0x24000001 },
-  { 0x210001f5, 0x1400ffff },
-  { 0x210001f6, 0x2400ff9f },
-  { 0x210001f7, 0x2400ffc8 },
-  { 0x210001f8, 0x24000001 },
-  { 0x210001f9, 0x1400ffff },
-  { 0x210001fa, 0x24000001 },
-  { 0x210001fb, 0x1400ffff },
-  { 0x210001fc, 0x24000001 },
-  { 0x210001fd, 0x1400ffff },
-  { 0x210001fe, 0x24000001 },
-  { 0x210001ff, 0x1400ffff },
-  { 0x21000200, 0x24000001 },
-  { 0x21000201, 0x1400ffff },
-  { 0x21000202, 0x24000001 },
-  { 0x21000203, 0x1400ffff },
-  { 0x21000204, 0x24000001 },
-  { 0x21000205, 0x1400ffff },
-  { 0x21000206, 0x24000001 },
-  { 0x21000207, 0x1400ffff },
-  { 0x21000208, 0x24000001 },
-  { 0x21000209, 0x1400ffff },
-  { 0x2100020a, 0x24000001 },
-  { 0x2100020b, 0x1400ffff },
-  { 0x2100020c, 0x24000001 },
-  { 0x2100020d, 0x1400ffff },
-  { 0x2100020e, 0x24000001 },
-  { 0x2100020f, 0x1400ffff },
-  { 0x21000210, 0x24000001 },
-  { 0x21000211, 0x1400ffff },
-  { 0x21000212, 0x24000001 },
-  { 0x21000213, 0x1400ffff },
-  { 0x21000214, 0x24000001 },
-  { 0x21000215, 0x1400ffff },
-  { 0x21000216, 0x24000001 },
-  { 0x21000217, 0x1400ffff },
-  { 0x21000218, 0x24000001 },
-  { 0x21000219, 0x1400ffff },
-  { 0x2100021a, 0x24000001 },
-  { 0x2100021b, 0x1400ffff },
-  { 0x2100021c, 0x24000001 },
-  { 0x2100021d, 0x1400ffff },
-  { 0x2100021e, 0x24000001 },
-  { 0x2100021f, 0x1400ffff },
-  { 0x21000220, 0x2400ff7e },
-  { 0x21000221, 0x14000000 },
-  { 0x21000222, 0x24000001 },
-  { 0x21000223, 0x1400ffff },
-  { 0x21000224, 0x24000001 },
-  { 0x21000225, 0x1400ffff },
-  { 0x21000226, 0x24000001 },
-  { 0x21000227, 0x1400ffff },
-  { 0x21000228, 0x24000001 },
-  { 0x21000229, 0x1400ffff },
-  { 0x2100022a, 0x24000001 },
-  { 0x2100022b, 0x1400ffff },
-  { 0x2100022c, 0x24000001 },
-  { 0x2100022d, 0x1400ffff },
-  { 0x2100022e, 0x24000001 },
-  { 0x2100022f, 0x1400ffff },
-  { 0x21000230, 0x24000001 },
-  { 0x21000231, 0x1400ffff },
-  { 0x21000232, 0x24000001 },
-  { 0x21000233, 0x1400ffff },
-  { 0x21800234, 0x14000005 },
-  { 0x2100023a, 0x24000000 },
-  { 0x2100023b, 0x24000001 },
-  { 0x2100023c, 0x1400ffff },
-  { 0x2100023d, 0x2400ff5d },
-  { 0x2100023e, 0x24000000 },
-  { 0x2180023f, 0x14000001 },
-  { 0x21000241, 0x24000053 },
-  { 0x21800250, 0x14000002 },
-  { 0x21000253, 0x1400ff2e },
-  { 0x21000254, 0x1400ff32 },
-  { 0x21000255, 0x14000000 },
-  { 0x21000256, 0x1400ff33 },
-  { 0x21000257, 0x1400ff33 },
-  { 0x21000258, 0x14000000 },
-  { 0x21000259, 0x1400ff36 },
-  { 0x2100025a, 0x14000000 },
-  { 0x2100025b, 0x1400ff35 },
-  { 0x2180025c, 0x14000003 },
-  { 0x21000260, 0x1400ff33 },
-  { 0x21800261, 0x14000001 },
-  { 0x21000263, 0x1400ff31 },
-  { 0x21800264, 0x14000003 },
-  { 0x21000268, 0x1400ff2f },
-  { 0x21000269, 0x1400ff2d },
-  { 0x2180026a, 0x14000004 },
-  { 0x2100026f, 0x1400ff2d },
-  { 0x21800270, 0x14000001 },
-  { 0x21000272, 0x1400ff2b },
-  { 0x21800273, 0x14000001 },
-  { 0x21000275, 0x1400ff2a },
-  { 0x21800276, 0x14000009 },
-  { 0x21000280, 0x1400ff26 },
-  { 0x21800281, 0x14000001 },
-  { 0x21000283, 0x1400ff26 },
-  { 0x21800284, 0x14000003 },
-  { 0x21000288, 0x1400ff26 },
-  { 0x21000289, 0x14000000 },
-  { 0x2100028a, 0x1400ff27 },
-  { 0x2100028b, 0x1400ff27 },
-  { 0x2180028c, 0x14000005 },
-  { 0x21000292, 0x1400ff25 },
-  { 0x21000293, 0x14000000 },
-  { 0x21000294, 0x1400ffad },
-  { 0x21800295, 0x1400001a },
-  { 0x218002b0, 0x18000011 },
-  { 0x098002c2, 0x60000003 },
-  { 0x098002c6, 0x1800000b },
-  { 0x098002d2, 0x6000000d },
-  { 0x218002e0, 0x18000004 },
-  { 0x098002e5, 0x60000008 },
-  { 0x090002ee, 0x18000000 },
-  { 0x098002ef, 0x60000010 },
-  { 0x1b800300, 0x30000044 },
-  { 0x1b000345, 0x30000054 },
-  { 0x1b800346, 0x30000029 },
-  { 0x13800374, 0x60000001 },
-  { 0x1300037a, 0x18000000 },
-  { 0x0900037e, 0x54000000 },
-  { 0x13800384, 0x60000001 },
-  { 0x13000386, 0x24000026 },
-  { 0x09000387, 0x54000000 },
-  { 0x13000388, 0x24000025 },
-  { 0x13000389, 0x24000025 },
-  { 0x1300038a, 0x24000025 },
-  { 0x1300038c, 0x24000040 },
-  { 0x1300038e, 0x2400003f },
-  { 0x1300038f, 0x2400003f },
-  { 0x13000390, 0x14000000 },
-  { 0x13000391, 0x24000020 },
-  { 0x13000392, 0x24000020 },
-  { 0x13000393, 0x24000020 },
-  { 0x13000394, 0x24000020 },
-  { 0x13000395, 0x24000020 },
-  { 0x13000396, 0x24000020 },
-  { 0x13000397, 0x24000020 },
-  { 0x13000398, 0x24000020 },
-  { 0x13000399, 0x24000020 },
-  { 0x1300039a, 0x24000020 },
-  { 0x1300039b, 0x24000020 },
-  { 0x1300039c, 0x24000020 },
-  { 0x1300039d, 0x24000020 },
-  { 0x1300039e, 0x24000020 },
-  { 0x1300039f, 0x24000020 },
-  { 0x130003a0, 0x24000020 },
-  { 0x130003a1, 0x24000020 },
-  { 0x130003a3, 0x24000020 },
-  { 0x130003a4, 0x24000020 },
-  { 0x130003a5, 0x24000020 },
-  { 0x130003a6, 0x24000020 },
-  { 0x130003a7, 0x24000020 },
-  { 0x130003a8, 0x24000020 },
-  { 0x130003a9, 0x24000020 },
-  { 0x130003aa, 0x24000020 },
-  { 0x130003ab, 0x24000020 },
-  { 0x130003ac, 0x1400ffda },
-  { 0x130003ad, 0x1400ffdb },
-  { 0x130003ae, 0x1400ffdb },
-  { 0x130003af, 0x1400ffdb },
-  { 0x130003b0, 0x14000000 },
-  { 0x130003b1, 0x1400ffe0 },
-  { 0x130003b2, 0x1400ffe0 },
-  { 0x130003b3, 0x1400ffe0 },
-  { 0x130003b4, 0x1400ffe0 },
-  { 0x130003b5, 0x1400ffe0 },
-  { 0x130003b6, 0x1400ffe0 },
-  { 0x130003b7, 0x1400ffe0 },
-  { 0x130003b8, 0x1400ffe0 },
-  { 0x130003b9, 0x1400ffe0 },
-  { 0x130003ba, 0x1400ffe0 },
-  { 0x130003bb, 0x1400ffe0 },
-  { 0x130003bc, 0x1400ffe0 },
-  { 0x130003bd, 0x1400ffe0 },
-  { 0x130003be, 0x1400ffe0 },
-  { 0x130003bf, 0x1400ffe0 },
-  { 0x130003c0, 0x1400ffe0 },
-  { 0x130003c1, 0x1400ffe0 },
-  { 0x130003c2, 0x1400ffe1 },
-  { 0x130003c3, 0x1400ffe0 },
-  { 0x130003c4, 0x1400ffe0 },
-  { 0x130003c5, 0x1400ffe0 },
-  { 0x130003c6, 0x1400ffe0 },
-  { 0x130003c7, 0x1400ffe0 },
-  { 0x130003c8, 0x1400ffe0 },
-  { 0x130003c9, 0x1400ffe0 },
-  { 0x130003ca, 0x1400ffe0 },
-  { 0x130003cb, 0x1400ffe0 },
-  { 0x130003cc, 0x1400ffc0 },
-  { 0x130003cd, 0x1400ffc1 },
-  { 0x130003ce, 0x1400ffc1 },
-  { 0x130003d0, 0x1400ffc2 },
-  { 0x130003d1, 0x1400ffc7 },
-  { 0x138003d2, 0x24000002 },
-  { 0x130003d5, 0x1400ffd1 },
-  { 0x130003d6, 0x1400ffca },
-  { 0x130003d7, 0x14000000 },
-  { 0x130003d8, 0x24000001 },
-  { 0x130003d9, 0x1400ffff },
-  { 0x130003da, 0x24000001 },
-  { 0x130003db, 0x1400ffff },
-  { 0x130003dc, 0x24000001 },
-  { 0x130003dd, 0x1400ffff },
-  { 0x130003de, 0x24000001 },
-  { 0x130003df, 0x1400ffff },
-  { 0x130003e0, 0x24000001 },
-  { 0x130003e1, 0x1400ffff },
-  { 0x0a0003e2, 0x24000001 },
-  { 0x0a0003e3, 0x1400ffff },
-  { 0x0a0003e4, 0x24000001 },
-  { 0x0a0003e5, 0x1400ffff },
-  { 0x0a0003e6, 0x24000001 },
-  { 0x0a0003e7, 0x1400ffff },
-  { 0x0a0003e8, 0x24000001 },
-  { 0x0a0003e9, 0x1400ffff },
-  { 0x0a0003ea, 0x24000001 },
-  { 0x0a0003eb, 0x1400ffff },
-  { 0x0a0003ec, 0x24000001 },
-  { 0x0a0003ed, 0x1400ffff },
-  { 0x0a0003ee, 0x24000001 },
-  { 0x0a0003ef, 0x1400ffff },
-  { 0x130003f0, 0x1400ffaa },
-  { 0x130003f1, 0x1400ffb0 },
-  { 0x130003f2, 0x14000007 },
-  { 0x130003f3, 0x14000000 },
-  { 0x130003f4, 0x2400ffc4 },
-  { 0x130003f5, 0x1400ffa0 },
-  { 0x130003f6, 0x64000000 },
-  { 0x130003f7, 0x24000001 },
-  { 0x130003f8, 0x1400ffff },
-  { 0x130003f9, 0x2400fff9 },
-  { 0x130003fa, 0x24000001 },
-  { 0x130003fb, 0x1400ffff },
-  { 0x130003fc, 0x14000000 },
-  { 0x138003fd, 0x24000002 },
-  { 0x0c000400, 0x24000050 },
-  { 0x0c000401, 0x24000050 },
-  { 0x0c000402, 0x24000050 },
-  { 0x0c000403, 0x24000050 },
-  { 0x0c000404, 0x24000050 },
-  { 0x0c000405, 0x24000050 },
-  { 0x0c000406, 0x24000050 },
-  { 0x0c000407, 0x24000050 },
-  { 0x0c000408, 0x24000050 },
-  { 0x0c000409, 0x24000050 },
-  { 0x0c00040a, 0x24000050 },
-  { 0x0c00040b, 0x24000050 },
-  { 0x0c00040c, 0x24000050 },
-  { 0x0c00040d, 0x24000050 },
-  { 0x0c00040e, 0x24000050 },
-  { 0x0c00040f, 0x24000050 },
-  { 0x0c000410, 0x24000020 },
-  { 0x0c000411, 0x24000020 },
-  { 0x0c000412, 0x24000020 },
-  { 0x0c000413, 0x24000020 },
-  { 0x0c000414, 0x24000020 },
-  { 0x0c000415, 0x24000020 },
-  { 0x0c000416, 0x24000020 },
-  { 0x0c000417, 0x24000020 },
-  { 0x0c000418, 0x24000020 },
-  { 0x0c000419, 0x24000020 },
-  { 0x0c00041a, 0x24000020 },
-  { 0x0c00041b, 0x24000020 },
-  { 0x0c00041c, 0x24000020 },
-  { 0x0c00041d, 0x24000020 },
-  { 0x0c00041e, 0x24000020 },
-  { 0x0c00041f, 0x24000020 },
-  { 0x0c000420, 0x24000020 },
-  { 0x0c000421, 0x24000020 },
-  { 0x0c000422, 0x24000020 },
-  { 0x0c000423, 0x24000020 },
-  { 0x0c000424, 0x24000020 },
-  { 0x0c000425, 0x24000020 },
-  { 0x0c000426, 0x24000020 },
-  { 0x0c000427, 0x24000020 },
-  { 0x0c000428, 0x24000020 },
-  { 0x0c000429, 0x24000020 },
-  { 0x0c00042a, 0x24000020 },
-  { 0x0c00042b, 0x24000020 },
-  { 0x0c00042c, 0x24000020 },
-  { 0x0c00042d, 0x24000020 },
-  { 0x0c00042e, 0x24000020 },
-  { 0x0c00042f, 0x24000020 },
-  { 0x0c000430, 0x1400ffe0 },
-  { 0x0c000431, 0x1400ffe0 },
-  { 0x0c000432, 0x1400ffe0 },
-  { 0x0c000433, 0x1400ffe0 },
-  { 0x0c000434, 0x1400ffe0 },
-  { 0x0c000435, 0x1400ffe0 },
-  { 0x0c000436, 0x1400ffe0 },
-  { 0x0c000437, 0x1400ffe0 },
-  { 0x0c000438, 0x1400ffe0 },
-  { 0x0c000439, 0x1400ffe0 },
-  { 0x0c00043a, 0x1400ffe0 },
-  { 0x0c00043b, 0x1400ffe0 },
-  { 0x0c00043c, 0x1400ffe0 },
-  { 0x0c00043d, 0x1400ffe0 },
-  { 0x0c00043e, 0x1400ffe0 },
-  { 0x0c00043f, 0x1400ffe0 },
-  { 0x0c000440, 0x1400ffe0 },
-  { 0x0c000441, 0x1400ffe0 },
-  { 0x0c000442, 0x1400ffe0 },
-  { 0x0c000443, 0x1400ffe0 },
-  { 0x0c000444, 0x1400ffe0 },
-  { 0x0c000445, 0x1400ffe0 },
-  { 0x0c000446, 0x1400ffe0 },
-  { 0x0c000447, 0x1400ffe0 },
-  { 0x0c000448, 0x1400ffe0 },
-  { 0x0c000449, 0x1400ffe0 },
-  { 0x0c00044a, 0x1400ffe0 },
-  { 0x0c00044b, 0x1400ffe0 },
-  { 0x0c00044c, 0x1400ffe0 },
-  { 0x0c00044d, 0x1400ffe0 },
-  { 0x0c00044e, 0x1400ffe0 },
-  { 0x0c00044f, 0x1400ffe0 },
-  { 0x0c000450, 0x1400ffb0 },
-  { 0x0c000451, 0x1400ffb0 },
-  { 0x0c000452, 0x1400ffb0 },
-  { 0x0c000453, 0x1400ffb0 },
-  { 0x0c000454, 0x1400ffb0 },
-  { 0x0c000455, 0x1400ffb0 },
-  { 0x0c000456, 0x1400ffb0 },
-  { 0x0c000457, 0x1400ffb0 },
-  { 0x0c000458, 0x1400ffb0 },
-  { 0x0c000459, 0x1400ffb0 },
-  { 0x0c00045a, 0x1400ffb0 },
-  { 0x0c00045b, 0x1400ffb0 },
-  { 0x0c00045c, 0x1400ffb0 },
-  { 0x0c00045d, 0x1400ffb0 },
-  { 0x0c00045e, 0x1400ffb0 },
-  { 0x0c00045f, 0x1400ffb0 },
-  { 0x0c000460, 0x24000001 },
-  { 0x0c000461, 0x1400ffff },
-  { 0x0c000462, 0x24000001 },
-  { 0x0c000463, 0x1400ffff },
-  { 0x0c000464, 0x24000001 },
-  { 0x0c000465, 0x1400ffff },
-  { 0x0c000466, 0x24000001 },
-  { 0x0c000467, 0x1400ffff },
-  { 0x0c000468, 0x24000001 },
-  { 0x0c000469, 0x1400ffff },
-  { 0x0c00046a, 0x24000001 },
-  { 0x0c00046b, 0x1400ffff },
-  { 0x0c00046c, 0x24000001 },
-  { 0x0c00046d, 0x1400ffff },
-  { 0x0c00046e, 0x24000001 },
-  { 0x0c00046f, 0x1400ffff },
-  { 0x0c000470, 0x24000001 },
-  { 0x0c000471, 0x1400ffff },
-  { 0x0c000472, 0x24000001 },
-  { 0x0c000473, 0x1400ffff },
-  { 0x0c000474, 0x24000001 },
-  { 0x0c000475, 0x1400ffff },
-  { 0x0c000476, 0x24000001 },
-  { 0x0c000477, 0x1400ffff },
-  { 0x0c000478, 0x24000001 },
-  { 0x0c000479, 0x1400ffff },
-  { 0x0c00047a, 0x24000001 },
-  { 0x0c00047b, 0x1400ffff },
-  { 0x0c00047c, 0x24000001 },
-  { 0x0c00047d, 0x1400ffff },
-  { 0x0c00047e, 0x24000001 },
-  { 0x0c00047f, 0x1400ffff },
-  { 0x0c000480, 0x24000001 },
-  { 0x0c000481, 0x1400ffff },
-  { 0x0c000482, 0x68000000 },
-  { 0x0c800483, 0x30000003 },
-  { 0x0c800488, 0x2c000001 },
-  { 0x0c00048a, 0x24000001 },
-  { 0x0c00048b, 0x1400ffff },
-  { 0x0c00048c, 0x24000001 },
-  { 0x0c00048d, 0x1400ffff },
-  { 0x0c00048e, 0x24000001 },
-  { 0x0c00048f, 0x1400ffff },
-  { 0x0c000490, 0x24000001 },
-  { 0x0c000491, 0x1400ffff },
-  { 0x0c000492, 0x24000001 },
-  { 0x0c000493, 0x1400ffff },
-  { 0x0c000494, 0x24000001 },
-  { 0x0c000495, 0x1400ffff },
-  { 0x0c000496, 0x24000001 },
-  { 0x0c000497, 0x1400ffff },
-  { 0x0c000498, 0x24000001 },
-  { 0x0c000499, 0x1400ffff },
-  { 0x0c00049a, 0x24000001 },
-  { 0x0c00049b, 0x1400ffff },
-  { 0x0c00049c, 0x24000001 },
-  { 0x0c00049d, 0x1400ffff },
-  { 0x0c00049e, 0x24000001 },
-  { 0x0c00049f, 0x1400ffff },
-  { 0x0c0004a0, 0x24000001 },
-  { 0x0c0004a1, 0x1400ffff },
-  { 0x0c0004a2, 0x24000001 },
-  { 0x0c0004a3, 0x1400ffff },
-  { 0x0c0004a4, 0x24000001 },
-  { 0x0c0004a5, 0x1400ffff },
-  { 0x0c0004a6, 0x24000001 },
-  { 0x0c0004a7, 0x1400ffff },
-  { 0x0c0004a8, 0x24000001 },
-  { 0x0c0004a9, 0x1400ffff },
-  { 0x0c0004aa, 0x24000001 },
-  { 0x0c0004ab, 0x1400ffff },
-  { 0x0c0004ac, 0x24000001 },
-  { 0x0c0004ad, 0x1400ffff },
-  { 0x0c0004ae, 0x24000001 },
-  { 0x0c0004af, 0x1400ffff },
-  { 0x0c0004b0, 0x24000001 },
-  { 0x0c0004b1, 0x1400ffff },
-  { 0x0c0004b2, 0x24000001 },
-  { 0x0c0004b3, 0x1400ffff },
-  { 0x0c0004b4, 0x24000001 },
-  { 0x0c0004b5, 0x1400ffff },
-  { 0x0c0004b6, 0x24000001 },
-  { 0x0c0004b7, 0x1400ffff },
-  { 0x0c0004b8, 0x24000001 },
-  { 0x0c0004b9, 0x1400ffff },
-  { 0x0c0004ba, 0x24000001 },
-  { 0x0c0004bb, 0x1400ffff },
-  { 0x0c0004bc, 0x24000001 },
-  { 0x0c0004bd, 0x1400ffff },
-  { 0x0c0004be, 0x24000001 },
-  { 0x0c0004bf, 0x1400ffff },
-  { 0x0c0004c0, 0x24000000 },
-  { 0x0c0004c1, 0x24000001 },
-  { 0x0c0004c2, 0x1400ffff },
-  { 0x0c0004c3, 0x24000001 },
-  { 0x0c0004c4, 0x1400ffff },
-  { 0x0c0004c5, 0x24000001 },
-  { 0x0c0004c6, 0x1400ffff },
-  { 0x0c0004c7, 0x24000001 },
-  { 0x0c0004c8, 0x1400ffff },
-  { 0x0c0004c9, 0x24000001 },
-  { 0x0c0004ca, 0x1400ffff },
-  { 0x0c0004cb, 0x24000001 },
-  { 0x0c0004cc, 0x1400ffff },
-  { 0x0c0004cd, 0x24000001 },
-  { 0x0c0004ce, 0x1400ffff },
-  { 0x0c0004d0, 0x24000001 },
-  { 0x0c0004d1, 0x1400ffff },
-  { 0x0c0004d2, 0x24000001 },
-  { 0x0c0004d3, 0x1400ffff },
-  { 0x0c0004d4, 0x24000001 },
-  { 0x0c0004d5, 0x1400ffff },
-  { 0x0c0004d6, 0x24000001 },
-  { 0x0c0004d7, 0x1400ffff },
-  { 0x0c0004d8, 0x24000001 },
-  { 0x0c0004d9, 0x1400ffff },
-  { 0x0c0004da, 0x24000001 },
-  { 0x0c0004db, 0x1400ffff },
-  { 0x0c0004dc, 0x24000001 },
-  { 0x0c0004dd, 0x1400ffff },
-  { 0x0c0004de, 0x24000001 },
-  { 0x0c0004df, 0x1400ffff },
-  { 0x0c0004e0, 0x24000001 },
-  { 0x0c0004e1, 0x1400ffff },
-  { 0x0c0004e2, 0x24000001 },
-  { 0x0c0004e3, 0x1400ffff },
-  { 0x0c0004e4, 0x24000001 },
-  { 0x0c0004e5, 0x1400ffff },
-  { 0x0c0004e6, 0x24000001 },
-  { 0x0c0004e7, 0x1400ffff },
-  { 0x0c0004e8, 0x24000001 },
-  { 0x0c0004e9, 0x1400ffff },
-  { 0x0c0004ea, 0x24000001 },
-  { 0x0c0004eb, 0x1400ffff },
-  { 0x0c0004ec, 0x24000001 },
-  { 0x0c0004ed, 0x1400ffff },
-  { 0x0c0004ee, 0x24000001 },
-  { 0x0c0004ef, 0x1400ffff },
-  { 0x0c0004f0, 0x24000001 },
-  { 0x0c0004f1, 0x1400ffff },
-  { 0x0c0004f2, 0x24000001 },
-  { 0x0c0004f3, 0x1400ffff },
-  { 0x0c0004f4, 0x24000001 },
-  { 0x0c0004f5, 0x1400ffff },
-  { 0x0c0004f6, 0x24000001 },
-  { 0x0c0004f7, 0x1400ffff },
-  { 0x0c0004f8, 0x24000001 },
-  { 0x0c0004f9, 0x1400ffff },
-  { 0x0c000500, 0x24000001 },
-  { 0x0c000501, 0x1400ffff },
-  { 0x0c000502, 0x24000001 },
-  { 0x0c000503, 0x1400ffff },
-  { 0x0c000504, 0x24000001 },
-  { 0x0c000505, 0x1400ffff },
-  { 0x0c000506, 0x24000001 },
-  { 0x0c000507, 0x1400ffff },
-  { 0x0c000508, 0x24000001 },
-  { 0x0c000509, 0x1400ffff },
-  { 0x0c00050a, 0x24000001 },
-  { 0x0c00050b, 0x1400ffff },
-  { 0x0c00050c, 0x24000001 },
-  { 0x0c00050d, 0x1400ffff },
-  { 0x0c00050e, 0x24000001 },
-  { 0x0c00050f, 0x1400ffff },
-  { 0x01000531, 0x24000030 },
-  { 0x01000532, 0x24000030 },
-  { 0x01000533, 0x24000030 },
-  { 0x01000534, 0x24000030 },
-  { 0x01000535, 0x24000030 },
-  { 0x01000536, 0x24000030 },
-  { 0x01000537, 0x24000030 },
-  { 0x01000538, 0x24000030 },
-  { 0x01000539, 0x24000030 },
-  { 0x0100053a, 0x24000030 },
-  { 0x0100053b, 0x24000030 },
-  { 0x0100053c, 0x24000030 },
-  { 0x0100053d, 0x24000030 },
-  { 0x0100053e, 0x24000030 },
-  { 0x0100053f, 0x24000030 },
-  { 0x01000540, 0x24000030 },
-  { 0x01000541, 0x24000030 },
-  { 0x01000542, 0x24000030 },
-  { 0x01000543, 0x24000030 },
-  { 0x01000544, 0x24000030 },
-  { 0x01000545, 0x24000030 },
-  { 0x01000546, 0x24000030 },
-  { 0x01000547, 0x24000030 },
-  { 0x01000548, 0x24000030 },
-  { 0x01000549, 0x24000030 },
-  { 0x0100054a, 0x24000030 },
-  { 0x0100054b, 0x24000030 },
-  { 0x0100054c, 0x24000030 },
-  { 0x0100054d, 0x24000030 },
-  { 0x0100054e, 0x24000030 },
-  { 0x0100054f, 0x24000030 },
-  { 0x01000550, 0x24000030 },
-  { 0x01000551, 0x24000030 },
-  { 0x01000552, 0x24000030 },
-  { 0x01000553, 0x24000030 },
-  { 0x01000554, 0x24000030 },
-  { 0x01000555, 0x24000030 },
-  { 0x01000556, 0x24000030 },
-  { 0x01000559, 0x18000000 },
-  { 0x0180055a, 0x54000005 },
-  { 0x01000561, 0x1400ffd0 },
-  { 0x01000562, 0x1400ffd0 },
-  { 0x01000563, 0x1400ffd0 },
-  { 0x01000564, 0x1400ffd0 },
-  { 0x01000565, 0x1400ffd0 },
-  { 0x01000566, 0x1400ffd0 },
-  { 0x01000567, 0x1400ffd0 },
-  { 0x01000568, 0x1400ffd0 },
-  { 0x01000569, 0x1400ffd0 },
-  { 0x0100056a, 0x1400ffd0 },
-  { 0x0100056b, 0x1400ffd0 },
-  { 0x0100056c, 0x1400ffd0 },
-  { 0x0100056d, 0x1400ffd0 },
-  { 0x0100056e, 0x1400ffd0 },
-  { 0x0100056f, 0x1400ffd0 },
-  { 0x01000570, 0x1400ffd0 },
-  { 0x01000571, 0x1400ffd0 },
-  { 0x01000572, 0x1400ffd0 },
-  { 0x01000573, 0x1400ffd0 },
-  { 0x01000574, 0x1400ffd0 },
-  { 0x01000575, 0x1400ffd0 },
-  { 0x01000576, 0x1400ffd0 },
-  { 0x01000577, 0x1400ffd0 },
-  { 0x01000578, 0x1400ffd0 },
-  { 0x01000579, 0x1400ffd0 },
-  { 0x0100057a, 0x1400ffd0 },
-  { 0x0100057b, 0x1400ffd0 },
-  { 0x0100057c, 0x1400ffd0 },
-  { 0x0100057d, 0x1400ffd0 },
-  { 0x0100057e, 0x1400ffd0 },
-  { 0x0100057f, 0x1400ffd0 },
-  { 0x01000580, 0x1400ffd0 },
-  { 0x01000581, 0x1400ffd0 },
-  { 0x01000582, 0x1400ffd0 },
-  { 0x01000583, 0x1400ffd0 },
-  { 0x01000584, 0x1400ffd0 },
-  { 0x01000585, 0x1400ffd0 },
-  { 0x01000586, 0x1400ffd0 },
-  { 0x01000587, 0x14000000 },
-  { 0x09000589, 0x54000000 },
-  { 0x0100058a, 0x44000000 },
-  { 0x19800591, 0x30000028 },
-  { 0x198005bb, 0x30000002 },
-  { 0x190005be, 0x54000000 },
-  { 0x190005bf, 0x30000000 },
-  { 0x190005c0, 0x54000000 },
-  { 0x198005c1, 0x30000001 },
-  { 0x190005c3, 0x54000000 },
-  { 0x198005c4, 0x30000001 },
-  { 0x190005c6, 0x54000000 },
-  { 0x190005c7, 0x30000000 },
-  { 0x198005d0, 0x1c00001a },
-  { 0x198005f0, 0x1c000002 },
-  { 0x198005f3, 0x54000001 },
-  { 0x09800600, 0x04000003 },
-  { 0x0000060b, 0x5c000000 },
-  { 0x0980060c, 0x54000001 },
-  { 0x0080060e, 0x68000001 },
-  { 0x00800610, 0x30000005 },
-  { 0x0900061b, 0x54000000 },
-  { 0x0080061e, 0x54000001 },
-  { 0x00800621, 0x1c000019 },
-  { 0x09000640, 0x18000000 },
-  { 0x00800641, 0x1c000009 },
-  { 0x1b80064b, 0x30000013 },
-  { 0x09800660, 0x34000009 },
-  { 0x0080066a, 0x54000003 },
-  { 0x0080066e, 0x1c000001 },
-  { 0x1b000670, 0x30000000 },
-  { 0x00800671, 0x1c000062 },
-  { 0x000006d4, 0x54000000 },
-  { 0x000006d5, 0x1c000000 },
-  { 0x008006d6, 0x30000006 },
-  { 0x090006dd, 0x04000000 },
-  { 0x000006de, 0x2c000000 },
-  { 0x008006df, 0x30000005 },
-  { 0x008006e5, 0x18000001 },
-  { 0x008006e7, 0x30000001 },
-  { 0x000006e9, 0x68000000 },
-  { 0x008006ea, 0x30000003 },
-  { 0x008006ee, 0x1c000001 },
-  { 0x008006f0, 0x34000009 },
-  { 0x008006fa, 0x1c000002 },
-  { 0x008006fd, 0x68000001 },
-  { 0x000006ff, 0x1c000000 },
-  { 0x31800700, 0x5400000d },
-  { 0x3100070f, 0x04000000 },
-  { 0x31000710, 0x1c000000 },
-  { 0x31000711, 0x30000000 },
-  { 0x31800712, 0x1c00001d },
-  { 0x31800730, 0x3000001a },
-  { 0x3180074d, 0x1c000020 },
-  { 0x37800780, 0x1c000025 },
-  { 0x378007a6, 0x3000000a },
-  { 0x370007b1, 0x1c000000 },
-  { 0x0e800901, 0x30000001 },
-  { 0x0e000903, 0x28000000 },
-  { 0x0e800904, 0x1c000035 },
-  { 0x0e00093c, 0x30000000 },
-  { 0x0e00093d, 0x1c000000 },
-  { 0x0e80093e, 0x28000002 },
-  { 0x0e800941, 0x30000007 },
-  { 0x0e800949, 0x28000003 },
-  { 0x0e00094d, 0x30000000 },
-  { 0x0e000950, 0x1c000000 },
-  { 0x0e800951, 0x30000003 },
-  { 0x0e800958, 0x1c000009 },
-  { 0x0e800962, 0x30000001 },
-  { 0x09800964, 0x54000001 },
-  { 0x0e800966, 0x34000009 },
-  { 0x09000970, 0x54000000 },
-  { 0x0e00097d, 0x1c000000 },
-  { 0x02000981, 0x30000000 },
-  { 0x02800982, 0x28000001 },
-  { 0x02800985, 0x1c000007 },
-  { 0x0280098f, 0x1c000001 },
-  { 0x02800993, 0x1c000015 },
-  { 0x028009aa, 0x1c000006 },
-  { 0x020009b2, 0x1c000000 },
-  { 0x028009b6, 0x1c000003 },
-  { 0x020009bc, 0x30000000 },
-  { 0x020009bd, 0x1c000000 },
-  { 0x028009be, 0x28000002 },
-  { 0x028009c1, 0x30000003 },
-  { 0x028009c7, 0x28000001 },
-  { 0x028009cb, 0x28000001 },
-  { 0x020009cd, 0x30000000 },
-  { 0x020009ce, 0x1c000000 },
-  { 0x020009d7, 0x28000000 },
-  { 0x028009dc, 0x1c000001 },
-  { 0x028009df, 0x1c000002 },
-  { 0x028009e2, 0x30000001 },
-  { 0x028009e6, 0x34000009 },
-  { 0x028009f0, 0x1c000001 },
-  { 0x028009f2, 0x5c000001 },
-  { 0x028009f4, 0x3c000005 },
-  { 0x020009fa, 0x68000000 },
-  { 0x15800a01, 0x30000001 },
-  { 0x15000a03, 0x28000000 },
-  { 0x15800a05, 0x1c000005 },
-  { 0x15800a0f, 0x1c000001 },
-  { 0x15800a13, 0x1c000015 },
-  { 0x15800a2a, 0x1c000006 },
-  { 0x15800a32, 0x1c000001 },
-  { 0x15800a35, 0x1c000001 },
-  { 0x15800a38, 0x1c000001 },
-  { 0x15000a3c, 0x30000000 },
-  { 0x15800a3e, 0x28000002 },
-  { 0x15800a41, 0x30000001 },
-  { 0x15800a47, 0x30000001 },
-  { 0x15800a4b, 0x30000002 },
-  { 0x15800a59, 0x1c000003 },
-  { 0x15000a5e, 0x1c000000 },
-  { 0x15800a66, 0x34000009 },
-  { 0x15800a70, 0x30000001 },
-  { 0x15800a72, 0x1c000002 },
-  { 0x14800a81, 0x30000001 },
-  { 0x14000a83, 0x28000000 },
-  { 0x14800a85, 0x1c000008 },
-  { 0x14800a8f, 0x1c000002 },
-  { 0x14800a93, 0x1c000015 },
-  { 0x14800aaa, 0x1c000006 },
-  { 0x14800ab2, 0x1c000001 },
-  { 0x14800ab5, 0x1c000004 },
-  { 0x14000abc, 0x30000000 },
-  { 0x14000abd, 0x1c000000 },
-  { 0x14800abe, 0x28000002 },
-  { 0x14800ac1, 0x30000004 },
-  { 0x14800ac7, 0x30000001 },
-  { 0x14000ac9, 0x28000000 },
-  { 0x14800acb, 0x28000001 },
-  { 0x14000acd, 0x30000000 },
-  { 0x14000ad0, 0x1c000000 },
-  { 0x14800ae0, 0x1c000001 },
-  { 0x14800ae2, 0x30000001 },
-  { 0x14800ae6, 0x34000009 },
-  { 0x14000af1, 0x5c000000 },
-  { 0x2b000b01, 0x30000000 },
-  { 0x2b800b02, 0x28000001 },
-  { 0x2b800b05, 0x1c000007 },
-  { 0x2b800b0f, 0x1c000001 },
-  { 0x2b800b13, 0x1c000015 },
-  { 0x2b800b2a, 0x1c000006 },
-  { 0x2b800b32, 0x1c000001 },
-  { 0x2b800b35, 0x1c000004 },
-  { 0x2b000b3c, 0x30000000 },
-  { 0x2b000b3d, 0x1c000000 },
-  { 0x2b000b3e, 0x28000000 },
-  { 0x2b000b3f, 0x30000000 },
-  { 0x2b000b40, 0x28000000 },
-  { 0x2b800b41, 0x30000002 },
-  { 0x2b800b47, 0x28000001 },
-  { 0x2b800b4b, 0x28000001 },
-  { 0x2b000b4d, 0x30000000 },
-  { 0x2b000b56, 0x30000000 },
-  { 0x2b000b57, 0x28000000 },
-  { 0x2b800b5c, 0x1c000001 },
-  { 0x2b800b5f, 0x1c000002 },
-  { 0x2b800b66, 0x34000009 },
-  { 0x2b000b70, 0x68000000 },
-  { 0x2b000b71, 0x1c000000 },
-  { 0x35000b82, 0x30000000 },
-  { 0x35000b83, 0x1c000000 },
-  { 0x35800b85, 0x1c000005 },
-  { 0x35800b8e, 0x1c000002 },
-  { 0x35800b92, 0x1c000003 },
-  { 0x35800b99, 0x1c000001 },
-  { 0x35000b9c, 0x1c000000 },
-  { 0x35800b9e, 0x1c000001 },
-  { 0x35800ba3, 0x1c000001 },
-  { 0x35800ba8, 0x1c000002 },
-  { 0x35800bae, 0x1c00000b },
-  { 0x35800bbe, 0x28000001 },
-  { 0x35000bc0, 0x30000000 },
-  { 0x35800bc1, 0x28000001 },
-  { 0x35800bc6, 0x28000002 },
-  { 0x35800bca, 0x28000002 },
-  { 0x35000bcd, 0x30000000 },
-  { 0x35000bd7, 0x28000000 },
-  { 0x35800be6, 0x34000009 },
-  { 0x35800bf0, 0x3c000002 },
-  { 0x35800bf3, 0x68000005 },
-  { 0x35000bf9, 0x5c000000 },
-  { 0x35000bfa, 0x68000000 },
-  { 0x36800c01, 0x28000002 },
-  { 0x36800c05, 0x1c000007 },
-  { 0x36800c0e, 0x1c000002 },
-  { 0x36800c12, 0x1c000016 },
-  { 0x36800c2a, 0x1c000009 },
-  { 0x36800c35, 0x1c000004 },
-  { 0x36800c3e, 0x30000002 },
-  { 0x36800c41, 0x28000003 },
-  { 0x36800c46, 0x30000002 },
-  { 0x36800c4a, 0x30000003 },
-  { 0x36800c55, 0x30000001 },
-  { 0x36800c60, 0x1c000001 },
-  { 0x36800c66, 0x34000009 },
-  { 0x1c800c82, 0x28000001 },
-  { 0x1c800c85, 0x1c000007 },
-  { 0x1c800c8e, 0x1c000002 },
-  { 0x1c800c92, 0x1c000016 },
-  { 0x1c800caa, 0x1c000009 },
-  { 0x1c800cb5, 0x1c000004 },
-  { 0x1c000cbc, 0x30000000 },
-  { 0x1c000cbd, 0x1c000000 },
-  { 0x1c000cbe, 0x28000000 },
-  { 0x1c000cbf, 0x30000000 },
-  { 0x1c800cc0, 0x28000004 },
-  { 0x1c000cc6, 0x30000000 },
-  { 0x1c800cc7, 0x28000001 },
-  { 0x1c800cca, 0x28000001 },
-  { 0x1c800ccc, 0x30000001 },
-  { 0x1c800cd5, 0x28000001 },
-  { 0x1c000cde, 0x1c000000 },
-  { 0x1c800ce0, 0x1c000001 },
-  { 0x1c800ce6, 0x34000009 },
-  { 0x24800d02, 0x28000001 },
-  { 0x24800d05, 0x1c000007 },
-  { 0x24800d0e, 0x1c000002 },
-  { 0x24800d12, 0x1c000016 },
-  { 0x24800d2a, 0x1c00000f },
-  { 0x24800d3e, 0x28000002 },
-  { 0x24800d41, 0x30000002 },
-  { 0x24800d46, 0x28000002 },
-  { 0x24800d4a, 0x28000002 },
-  { 0x24000d4d, 0x30000000 },
-  { 0x24000d57, 0x28000000 },
-  { 0x24800d60, 0x1c000001 },
-  { 0x24800d66, 0x34000009 },
-  { 0x2f800d82, 0x28000001 },
-  { 0x2f800d85, 0x1c000011 },
-  { 0x2f800d9a, 0x1c000017 },
-  { 0x2f800db3, 0x1c000008 },
-  { 0x2f000dbd, 0x1c000000 },
-  { 0x2f800dc0, 0x1c000006 },
-  { 0x2f000dca, 0x30000000 },
-  { 0x2f800dcf, 0x28000002 },
-  { 0x2f800dd2, 0x30000002 },
-  { 0x2f000dd6, 0x30000000 },
-  { 0x2f800dd8, 0x28000007 },
-  { 0x2f800df2, 0x28000001 },
-  { 0x2f000df4, 0x54000000 },
-  { 0x38800e01, 0x1c00002f },
-  { 0x38000e31, 0x30000000 },
-  { 0x38800e32, 0x1c000001 },
-  { 0x38800e34, 0x30000006 },
-  { 0x09000e3f, 0x5c000000 },
-  { 0x38800e40, 0x1c000005 },
-  { 0x38000e46, 0x18000000 },
-  { 0x38800e47, 0x30000007 },
-  { 0x38000e4f, 0x54000000 },
-  { 0x38800e50, 0x34000009 },
-  { 0x38800e5a, 0x54000001 },
-  { 0x20800e81, 0x1c000001 },
-  { 0x20000e84, 0x1c000000 },
-  { 0x20800e87, 0x1c000001 },
-  { 0x20000e8a, 0x1c000000 },
-  { 0x20000e8d, 0x1c000000 },
-  { 0x20800e94, 0x1c000003 },
-  { 0x20800e99, 0x1c000006 },
-  { 0x20800ea1, 0x1c000002 },
-  { 0x20000ea5, 0x1c000000 },
-  { 0x20000ea7, 0x1c000000 },
-  { 0x20800eaa, 0x1c000001 },
-  { 0x20800ead, 0x1c000003 },
-  { 0x20000eb1, 0x30000000 },
-  { 0x20800eb2, 0x1c000001 },
-  { 0x20800eb4, 0x30000005 },
-  { 0x20800ebb, 0x30000001 },
-  { 0x20000ebd, 0x1c000000 },
-  { 0x20800ec0, 0x1c000004 },
-  { 0x20000ec6, 0x18000000 },
-  { 0x20800ec8, 0x30000005 },
-  { 0x20800ed0, 0x34000009 },
-  { 0x20800edc, 0x1c000001 },
-  { 0x39000f00, 0x1c000000 },
-  { 0x39800f01, 0x68000002 },
-  { 0x39800f04, 0x5400000e },
-  { 0x39800f13, 0x68000004 },
-  { 0x39800f18, 0x30000001 },
-  { 0x39800f1a, 0x68000005 },
-  { 0x39800f20, 0x34000009 },
-  { 0x39800f2a, 0x3c000009 },
-  { 0x39000f34, 0x68000000 },
-  { 0x39000f35, 0x30000000 },
-  { 0x39000f36, 0x68000000 },
-  { 0x39000f37, 0x30000000 },
-  { 0x39000f38, 0x68000000 },
-  { 0x39000f39, 0x30000000 },
-  { 0x39000f3a, 0x58000000 },
-  { 0x39000f3b, 0x48000000 },
-  { 0x39000f3c, 0x58000000 },
-  { 0x39000f3d, 0x48000000 },
-  { 0x39800f3e, 0x28000001 },
-  { 0x39800f40, 0x1c000007 },
-  { 0x39800f49, 0x1c000021 },
-  { 0x39800f71, 0x3000000d },
-  { 0x39000f7f, 0x28000000 },
-  { 0x39800f80, 0x30000004 },
-  { 0x39000f85, 0x54000000 },
-  { 0x39800f86, 0x30000001 },
-  { 0x39800f88, 0x1c000003 },
-  { 0x39800f90, 0x30000007 },
-  { 0x39800f99, 0x30000023 },
-  { 0x39800fbe, 0x68000007 },
-  { 0x39000fc6, 0x30000000 },
-  { 0x39800fc7, 0x68000005 },
-  { 0x39000fcf, 0x68000000 },
-  { 0x39800fd0, 0x54000001 },
-  { 0x26801000, 0x1c000021 },
-  { 0x26801023, 0x1c000004 },
-  { 0x26801029, 0x1c000001 },
-  { 0x2600102c, 0x28000000 },
-  { 0x2680102d, 0x30000003 },
-  { 0x26001031, 0x28000000 },
-  { 0x26001032, 0x30000000 },
-  { 0x26801036, 0x30000001 },
-  { 0x26001038, 0x28000000 },
-  { 0x26001039, 0x30000000 },
-  { 0x26801040, 0x34000009 },
-  { 0x2680104a, 0x54000005 },
-  { 0x26801050, 0x1c000005 },
-  { 0x26801056, 0x28000001 },
-  { 0x26801058, 0x30000001 },
-  { 0x100010a0, 0x24001c60 },
-  { 0x100010a1, 0x24001c60 },
-  { 0x100010a2, 0x24001c60 },
-  { 0x100010a3, 0x24001c60 },
-  { 0x100010a4, 0x24001c60 },
-  { 0x100010a5, 0x24001c60 },
-  { 0x100010a6, 0x24001c60 },
-  { 0x100010a7, 0x24001c60 },
-  { 0x100010a8, 0x24001c60 },
-  { 0x100010a9, 0x24001c60 },
-  { 0x100010aa, 0x24001c60 },
-  { 0x100010ab, 0x24001c60 },
-  { 0x100010ac, 0x24001c60 },
-  { 0x100010ad, 0x24001c60 },
-  { 0x100010ae, 0x24001c60 },
-  { 0x100010af, 0x24001c60 },
-  { 0x100010b0, 0x24001c60 },
-  { 0x100010b1, 0x24001c60 },
-  { 0x100010b2, 0x24001c60 },
-  { 0x100010b3, 0x24001c60 },
-  { 0x100010b4, 0x24001c60 },
-  { 0x100010b5, 0x24001c60 },
-  { 0x100010b6, 0x24001c60 },
-  { 0x100010b7, 0x24001c60 },
-  { 0x100010b8, 0x24001c60 },
-  { 0x100010b9, 0x24001c60 },
-  { 0x100010ba, 0x24001c60 },
-  { 0x100010bb, 0x24001c60 },
-  { 0x100010bc, 0x24001c60 },
-  { 0x100010bd, 0x24001c60 },
-  { 0x100010be, 0x24001c60 },
-  { 0x100010bf, 0x24001c60 },
-  { 0x100010c0, 0x24001c60 },
-  { 0x100010c1, 0x24001c60 },
-  { 0x100010c2, 0x24001c60 },
-  { 0x100010c3, 0x24001c60 },
-  { 0x100010c4, 0x24001c60 },
-  { 0x100010c5, 0x24001c60 },
-  { 0x108010d0, 0x1c00002a },
-  { 0x090010fb, 0x54000000 },
-  { 0x100010fc, 0x18000000 },
-  { 0x17801100, 0x1c000059 },
-  { 0x1780115f, 0x1c000043 },
-  { 0x178011a8, 0x1c000051 },
-  { 0x0f801200, 0x1c000048 },
-  { 0x0f80124a, 0x1c000003 },
-  { 0x0f801250, 0x1c000006 },
-  { 0x0f001258, 0x1c000000 },
-  { 0x0f80125a, 0x1c000003 },
-  { 0x0f801260, 0x1c000028 },
-  { 0x0f80128a, 0x1c000003 },
-  { 0x0f801290, 0x1c000020 },
-  { 0x0f8012b2, 0x1c000003 },
-  { 0x0f8012b8, 0x1c000006 },
-  { 0x0f0012c0, 0x1c000000 },
-  { 0x0f8012c2, 0x1c000003 },
-  { 0x0f8012c8, 0x1c00000e },
-  { 0x0f8012d8, 0x1c000038 },
-  { 0x0f801312, 0x1c000003 },
-  { 0x0f801318, 0x1c000042 },
-  { 0x0f00135f, 0x30000000 },
-  { 0x0f001360, 0x68000000 },
-  { 0x0f801361, 0x54000007 },
-  { 0x0f801369, 0x3c000013 },
-  { 0x0f801380, 0x1c00000f },
-  { 0x0f801390, 0x68000009 },
-  { 0x088013a0, 0x1c000054 },
-  { 0x07801401, 0x1c00026b },
-  { 0x0780166d, 0x54000001 },
-  { 0x0780166f, 0x1c000007 },
-  { 0x28001680, 0x74000000 },
-  { 0x28801681, 0x1c000019 },
-  { 0x2800169b, 0x58000000 },
-  { 0x2800169c, 0x48000000 },
-  { 0x2d8016a0, 0x1c00004a },
-  { 0x098016eb, 0x54000002 },
-  { 0x2d8016ee, 0x38000002 },
-  { 0x32801700, 0x1c00000c },
-  { 0x3280170e, 0x1c000003 },
-  { 0x32801712, 0x30000002 },
-  { 0x18801720, 0x1c000011 },
-  { 0x18801732, 0x30000002 },
-  { 0x09801735, 0x54000001 },
-  { 0x06801740, 0x1c000011 },
-  { 0x06801752, 0x30000001 },
-  { 0x33801760, 0x1c00000c },
-  { 0x3380176e, 0x1c000002 },
-  { 0x33801772, 0x30000001 },
-  { 0x1f801780, 0x1c000033 },
-  { 0x1f8017b4, 0x04000001 },
-  { 0x1f0017b6, 0x28000000 },
-  { 0x1f8017b7, 0x30000006 },
-  { 0x1f8017be, 0x28000007 },
-  { 0x1f0017c6, 0x30000000 },
-  { 0x1f8017c7, 0x28000001 },
-  { 0x1f8017c9, 0x3000000a },
-  { 0x1f8017d4, 0x54000002 },
-  { 0x1f0017d7, 0x18000000 },
-  { 0x1f8017d8, 0x54000002 },
-  { 0x1f0017db, 0x5c000000 },
-  { 0x1f0017dc, 0x1c000000 },
-  { 0x1f0017dd, 0x30000000 },
-  { 0x1f8017e0, 0x34000009 },
-  { 0x1f8017f0, 0x3c000009 },
-  { 0x25801800, 0x54000005 },
-  { 0x25001806, 0x44000000 },
-  { 0x25801807, 0x54000003 },
-  { 0x2580180b, 0x30000002 },
-  { 0x2500180e, 0x74000000 },
-  { 0x25801810, 0x34000009 },
-  { 0x25801820, 0x1c000022 },
-  { 0x25001843, 0x18000000 },
-  { 0x25801844, 0x1c000033 },
-  { 0x25801880, 0x1c000028 },
-  { 0x250018a9, 0x30000000 },
-  { 0x22801900, 0x1c00001c },
-  { 0x22801920, 0x30000002 },
-  { 0x22801923, 0x28000003 },
-  { 0x22801927, 0x30000001 },
-  { 0x22801929, 0x28000002 },
-  { 0x22801930, 0x28000001 },
-  { 0x22001932, 0x30000000 },
-  { 0x22801933, 0x28000005 },
-  { 0x22801939, 0x30000002 },
-  { 0x22001940, 0x68000000 },
-  { 0x22801944, 0x54000001 },
-  { 0x22801946, 0x34000009 },
-  { 0x34801950, 0x1c00001d },
-  { 0x34801970, 0x1c000004 },
-  { 0x27801980, 0x1c000029 },
-  { 0x278019b0, 0x28000010 },
-  { 0x278019c1, 0x1c000006 },
-  { 0x278019c8, 0x28000001 },
-  { 0x278019d0, 0x34000009 },
-  { 0x278019de, 0x54000001 },
-  { 0x1f8019e0, 0x6800001f },
-  { 0x05801a00, 0x1c000016 },
-  { 0x05801a17, 0x30000001 },
-  { 0x05801a19, 0x28000002 },
-  { 0x05801a1e, 0x54000001 },
-  { 0x21801d00, 0x1400002b },
-  { 0x21801d2c, 0x18000035 },
-  { 0x21801d62, 0x14000015 },
-  { 0x0c001d78, 0x18000000 },
-  { 0x21801d79, 0x14000021 },
-  { 0x21801d9b, 0x18000024 },
-  { 0x1b801dc0, 0x30000003 },
-  { 0x21001e00, 0x24000001 },
-  { 0x21001e01, 0x1400ffff },
-  { 0x21001e02, 0x24000001 },
-  { 0x21001e03, 0x1400ffff },
-  { 0x21001e04, 0x24000001 },
-  { 0x21001e05, 0x1400ffff },
-  { 0x21001e06, 0x24000001 },
-  { 0x21001e07, 0x1400ffff },
-  { 0x21001e08, 0x24000001 },
-  { 0x21001e09, 0x1400ffff },
-  { 0x21001e0a, 0x24000001 },
-  { 0x21001e0b, 0x1400ffff },
-  { 0x21001e0c, 0x24000001 },
-  { 0x21001e0d, 0x1400ffff },
-  { 0x21001e0e, 0x24000001 },
-  { 0x21001e0f, 0x1400ffff },
-  { 0x21001e10, 0x24000001 },
-  { 0x21001e11, 0x1400ffff },
-  { 0x21001e12, 0x24000001 },
-  { 0x21001e13, 0x1400ffff },
-  { 0x21001e14, 0x24000001 },
-  { 0x21001e15, 0x1400ffff },
-  { 0x21001e16, 0x24000001 },
-  { 0x21001e17, 0x1400ffff },
-  { 0x21001e18, 0x24000001 },
-  { 0x21001e19, 0x1400ffff },
-  { 0x21001e1a, 0x24000001 },
-  { 0x21001e1b, 0x1400ffff },
-  { 0x21001e1c, 0x24000001 },
-  { 0x21001e1d, 0x1400ffff },
-  { 0x21001e1e, 0x24000001 },
-  { 0x21001e1f, 0x1400ffff },
-  { 0x21001e20, 0x24000001 },
-  { 0x21001e21, 0x1400ffff },
-  { 0x21001e22, 0x24000001 },
-  { 0x21001e23, 0x1400ffff },
-  { 0x21001e24, 0x24000001 },
-  { 0x21001e25, 0x1400ffff },
-  { 0x21001e26, 0x24000001 },
-  { 0x21001e27, 0x1400ffff },
-  { 0x21001e28, 0x24000001 },
-  { 0x21001e29, 0x1400ffff },
-  { 0x21001e2a, 0x24000001 },
-  { 0x21001e2b, 0x1400ffff },
-  { 0x21001e2c, 0x24000001 },
-  { 0x21001e2d, 0x1400ffff },
-  { 0x21001e2e, 0x24000001 },
-  { 0x21001e2f, 0x1400ffff },
-  { 0x21001e30, 0x24000001 },
-  { 0x21001e31, 0x1400ffff },
-  { 0x21001e32, 0x24000001 },
-  { 0x21001e33, 0x1400ffff },
-  { 0x21001e34, 0x24000001 },
-  { 0x21001e35, 0x1400ffff },
-  { 0x21001e36, 0x24000001 },
-  { 0x21001e37, 0x1400ffff },
-  { 0x21001e38, 0x24000001 },
-  { 0x21001e39, 0x1400ffff },
-  { 0x21001e3a, 0x24000001 },
-  { 0x21001e3b, 0x1400ffff },
-  { 0x21001e3c, 0x24000001 },
-  { 0x21001e3d, 0x1400ffff },
-  { 0x21001e3e, 0x24000001 },
-  { 0x21001e3f, 0x1400ffff },
-  { 0x21001e40, 0x24000001 },
-  { 0x21001e41, 0x1400ffff },
-  { 0x21001e42, 0x24000001 },
-  { 0x21001e43, 0x1400ffff },
-  { 0x21001e44, 0x24000001 },
-  { 0x21001e45, 0x1400ffff },
-  { 0x21001e46, 0x24000001 },
-  { 0x21001e47, 0x1400ffff },
-  { 0x21001e48, 0x24000001 },
-  { 0x21001e49, 0x1400ffff },
-  { 0x21001e4a, 0x24000001 },
-  { 0x21001e4b, 0x1400ffff },
-  { 0x21001e4c, 0x24000001 },
-  { 0x21001e4d, 0x1400ffff },
-  { 0x21001e4e, 0x24000001 },
-  { 0x21001e4f, 0x1400ffff },
-  { 0x21001e50, 0x24000001 },
-  { 0x21001e51, 0x1400ffff },
-  { 0x21001e52, 0x24000001 },
-  { 0x21001e53, 0x1400ffff },
-  { 0x21001e54, 0x24000001 },
-  { 0x21001e55, 0x1400ffff },
-  { 0x21001e56, 0x24000001 },
-  { 0x21001e57, 0x1400ffff },
-  { 0x21001e58, 0x24000001 },
-  { 0x21001e59, 0x1400ffff },
-  { 0x21001e5a, 0x24000001 },
-  { 0x21001e5b, 0x1400ffff },
-  { 0x21001e5c, 0x24000001 },
-  { 0x21001e5d, 0x1400ffff },
-  { 0x21001e5e, 0x24000001 },
-  { 0x21001e5f, 0x1400ffff },
-  { 0x21001e60, 0x24000001 },
-  { 0x21001e61, 0x1400ffff },
-  { 0x21001e62, 0x24000001 },
-  { 0x21001e63, 0x1400ffff },
-  { 0x21001e64, 0x24000001 },
-  { 0x21001e65, 0x1400ffff },
-  { 0x21001e66, 0x24000001 },
-  { 0x21001e67, 0x1400ffff },
-  { 0x21001e68, 0x24000001 },
-  { 0x21001e69, 0x1400ffff },
-  { 0x21001e6a, 0x24000001 },
-  { 0x21001e6b, 0x1400ffff },
-  { 0x21001e6c, 0x24000001 },
-  { 0x21001e6d, 0x1400ffff },
-  { 0x21001e6e, 0x24000001 },
-  { 0x21001e6f, 0x1400ffff },
-  { 0x21001e70, 0x24000001 },
-  { 0x21001e71, 0x1400ffff },
-  { 0x21001e72, 0x24000001 },
-  { 0x21001e73, 0x1400ffff },
-  { 0x21001e74, 0x24000001 },
-  { 0x21001e75, 0x1400ffff },
-  { 0x21001e76, 0x24000001 },
-  { 0x21001e77, 0x1400ffff },
-  { 0x21001e78, 0x24000001 },
-  { 0x21001e79, 0x1400ffff },
-  { 0x21001e7a, 0x24000001 },
-  { 0x21001e7b, 0x1400ffff },
-  { 0x21001e7c, 0x24000001 },
-  { 0x21001e7d, 0x1400ffff },
-  { 0x21001e7e, 0x24000001 },
-  { 0x21001e7f, 0x1400ffff },
-  { 0x21001e80, 0x24000001 },
-  { 0x21001e81, 0x1400ffff },
-  { 0x21001e82, 0x24000001 },
-  { 0x21001e83, 0x1400ffff },
-  { 0x21001e84, 0x24000001 },
-  { 0x21001e85, 0x1400ffff },
-  { 0x21001e86, 0x24000001 },
-  { 0x21001e87, 0x1400ffff },
-  { 0x21001e88, 0x24000001 },
-  { 0x21001e89, 0x1400ffff },
-  { 0x21001e8a, 0x24000001 },
-  { 0x21001e8b, 0x1400ffff },
-  { 0x21001e8c, 0x24000001 },
-  { 0x21001e8d, 0x1400ffff },
-  { 0x21001e8e, 0x24000001 },
-  { 0x21001e8f, 0x1400ffff },
-  { 0x21001e90, 0x24000001 },
-  { 0x21001e91, 0x1400ffff },
-  { 0x21001e92, 0x24000001 },
-  { 0x21001e93, 0x1400ffff },
-  { 0x21001e94, 0x24000001 },
-  { 0x21001e95, 0x1400ffff },
-  { 0x21801e96, 0x14000004 },
-  { 0x21001e9b, 0x1400ffc5 },
-  { 0x21001ea0, 0x24000001 },
-  { 0x21001ea1, 0x1400ffff },
-  { 0x21001ea2, 0x24000001 },
-  { 0x21001ea3, 0x1400ffff },
-  { 0x21001ea4, 0x24000001 },
-  { 0x21001ea5, 0x1400ffff },
-  { 0x21001ea6, 0x24000001 },
-  { 0x21001ea7, 0x1400ffff },
-  { 0x21001ea8, 0x24000001 },
-  { 0x21001ea9, 0x1400ffff },
-  { 0x21001eaa, 0x24000001 },
-  { 0x21001eab, 0x1400ffff },
-  { 0x21001eac, 0x24000001 },
-  { 0x21001ead, 0x1400ffff },
-  { 0x21001eae, 0x24000001 },
-  { 0x21001eaf, 0x1400ffff },
-  { 0x21001eb0, 0x24000001 },
-  { 0x21001eb1, 0x1400ffff },
-  { 0x21001eb2, 0x24000001 },
-  { 0x21001eb3, 0x1400ffff },
-  { 0x21001eb4, 0x24000001 },
-  { 0x21001eb5, 0x1400ffff },
-  { 0x21001eb6, 0x24000001 },
-  { 0x21001eb7, 0x1400ffff },
-  { 0x21001eb8, 0x24000001 },
-  { 0x21001eb9, 0x1400ffff },
-  { 0x21001eba, 0x24000001 },
-  { 0x21001ebb, 0x1400ffff },
-  { 0x21001ebc, 0x24000001 },
-  { 0x21001ebd, 0x1400ffff },
-  { 0x21001ebe, 0x24000001 },
-  { 0x21001ebf, 0x1400ffff },
-  { 0x21001ec0, 0x24000001 },
-  { 0x21001ec1, 0x1400ffff },
-  { 0x21001ec2, 0x24000001 },
-  { 0x21001ec3, 0x1400ffff },
-  { 0x21001ec4, 0x24000001 },
-  { 0x21001ec5, 0x1400ffff },
-  { 0x21001ec6, 0x24000001 },
-  { 0x21001ec7, 0x1400ffff },
-  { 0x21001ec8, 0x24000001 },
-  { 0x21001ec9, 0x1400ffff },
-  { 0x21001eca, 0x24000001 },
-  { 0x21001ecb, 0x1400ffff },
-  { 0x21001ecc, 0x24000001 },
-  { 0x21001ecd, 0x1400ffff },
-  { 0x21001ece, 0x24000001 },
-  { 0x21001ecf, 0x1400ffff },
-  { 0x21001ed0, 0x24000001 },
-  { 0x21001ed1, 0x1400ffff },
-  { 0x21001ed2, 0x24000001 },
-  { 0x21001ed3, 0x1400ffff },
-  { 0x21001ed4, 0x24000001 },
-  { 0x21001ed5, 0x1400ffff },
-  { 0x21001ed6, 0x24000001 },
-  { 0x21001ed7, 0x1400ffff },
-  { 0x21001ed8, 0x24000001 },
-  { 0x21001ed9, 0x1400ffff },
-  { 0x21001eda, 0x24000001 },
-  { 0x21001edb, 0x1400ffff },
-  { 0x21001edc, 0x24000001 },
-  { 0x21001edd, 0x1400ffff },
-  { 0x21001ede, 0x24000001 },
-  { 0x21001edf, 0x1400ffff },
-  { 0x21001ee0, 0x24000001 },
-  { 0x21001ee1, 0x1400ffff },
-  { 0x21001ee2, 0x24000001 },
-  { 0x21001ee3, 0x1400ffff },
-  { 0x21001ee4, 0x24000001 },
-  { 0x21001ee5, 0x1400ffff },
-  { 0x21001ee6, 0x24000001 },
-  { 0x21001ee7, 0x1400ffff },
-  { 0x21001ee8, 0x24000001 },
-  { 0x21001ee9, 0x1400ffff },
-  { 0x21001eea, 0x24000001 },
-  { 0x21001eeb, 0x1400ffff },
-  { 0x21001eec, 0x24000001 },
-  { 0x21001eed, 0x1400ffff },
-  { 0x21001eee, 0x24000001 },
-  { 0x21001eef, 0x1400ffff },
-  { 0x21001ef0, 0x24000001 },
-  { 0x21001ef1, 0x1400ffff },
-  { 0x21001ef2, 0x24000001 },
-  { 0x21001ef3, 0x1400ffff },
-  { 0x21001ef4, 0x24000001 },
-  { 0x21001ef5, 0x1400ffff },
-  { 0x21001ef6, 0x24000001 },
-  { 0x21001ef7, 0x1400ffff },
-  { 0x21001ef8, 0x24000001 },
-  { 0x21001ef9, 0x1400ffff },
-  { 0x13001f00, 0x14000008 },
-  { 0x13001f01, 0x14000008 },
-  { 0x13001f02, 0x14000008 },
-  { 0x13001f03, 0x14000008 },
-  { 0x13001f04, 0x14000008 },
-  { 0x13001f05, 0x14000008 },
-  { 0x13001f06, 0x14000008 },
-  { 0x13001f07, 0x14000008 },
-  { 0x13001f08, 0x2400fff8 },
-  { 0x13001f09, 0x2400fff8 },
-  { 0x13001f0a, 0x2400fff8 },
-  { 0x13001f0b, 0x2400fff8 },
-  { 0x13001f0c, 0x2400fff8 },
-  { 0x13001f0d, 0x2400fff8 },
-  { 0x13001f0e, 0x2400fff8 },
-  { 0x13001f0f, 0x2400fff8 },
-  { 0x13001f10, 0x14000008 },
-  { 0x13001f11, 0x14000008 },
-  { 0x13001f12, 0x14000008 },
-  { 0x13001f13, 0x14000008 },
-  { 0x13001f14, 0x14000008 },
-  { 0x13001f15, 0x14000008 },
-  { 0x13001f18, 0x2400fff8 },
-  { 0x13001f19, 0x2400fff8 },
-  { 0x13001f1a, 0x2400fff8 },
-  { 0x13001f1b, 0x2400fff8 },
-  { 0x13001f1c, 0x2400fff8 },
-  { 0x13001f1d, 0x2400fff8 },
-  { 0x13001f20, 0x14000008 },
-  { 0x13001f21, 0x14000008 },
-  { 0x13001f22, 0x14000008 },
-  { 0x13001f23, 0x14000008 },
-  { 0x13001f24, 0x14000008 },
-  { 0x13001f25, 0x14000008 },
-  { 0x13001f26, 0x14000008 },
-  { 0x13001f27, 0x14000008 },
-  { 0x13001f28, 0x2400fff8 },
-  { 0x13001f29, 0x2400fff8 },
-  { 0x13001f2a, 0x2400fff8 },
-  { 0x13001f2b, 0x2400fff8 },
-  { 0x13001f2c, 0x2400fff8 },
-  { 0x13001f2d, 0x2400fff8 },
-  { 0x13001f2e, 0x2400fff8 },
-  { 0x13001f2f, 0x2400fff8 },
-  { 0x13001f30, 0x14000008 },
-  { 0x13001f31, 0x14000008 },
-  { 0x13001f32, 0x14000008 },
-  { 0x13001f33, 0x14000008 },
-  { 0x13001f34, 0x14000008 },
-  { 0x13001f35, 0x14000008 },
-  { 0x13001f36, 0x14000008 },
-  { 0x13001f37, 0x14000008 },
-  { 0x13001f38, 0x2400fff8 },
-  { 0x13001f39, 0x2400fff8 },
-  { 0x13001f3a, 0x2400fff8 },
-  { 0x13001f3b, 0x2400fff8 },
-  { 0x13001f3c, 0x2400fff8 },
-  { 0x13001f3d, 0x2400fff8 },
-  { 0x13001f3e, 0x2400fff8 },
-  { 0x13001f3f, 0x2400fff8 },
-  { 0x13001f40, 0x14000008 },
-  { 0x13001f41, 0x14000008 },
-  { 0x13001f42, 0x14000008 },
-  { 0x13001f43, 0x14000008 },
-  { 0x13001f44, 0x14000008 },
-  { 0x13001f45, 0x14000008 },
-  { 0x13001f48, 0x2400fff8 },
-  { 0x13001f49, 0x2400fff8 },
-  { 0x13001f4a, 0x2400fff8 },
-  { 0x13001f4b, 0x2400fff8 },
-  { 0x13001f4c, 0x2400fff8 },
-  { 0x13001f4d, 0x2400fff8 },
-  { 0x13001f50, 0x14000000 },
-  { 0x13001f51, 0x14000008 },
-  { 0x13001f52, 0x14000000 },
-  { 0x13001f53, 0x14000008 },
-  { 0x13001f54, 0x14000000 },
-  { 0x13001f55, 0x14000008 },
-  { 0x13001f56, 0x14000000 },
-  { 0x13001f57, 0x14000008 },
-  { 0x13001f59, 0x2400fff8 },
-  { 0x13001f5b, 0x2400fff8 },
-  { 0x13001f5d, 0x2400fff8 },
-  { 0x13001f5f, 0x2400fff8 },
-  { 0x13001f60, 0x14000008 },
-  { 0x13001f61, 0x14000008 },
-  { 0x13001f62, 0x14000008 },
-  { 0x13001f63, 0x14000008 },
-  { 0x13001f64, 0x14000008 },
-  { 0x13001f65, 0x14000008 },
-  { 0x13001f66, 0x14000008 },
-  { 0x13001f67, 0x14000008 },
-  { 0x13001f68, 0x2400fff8 },
-  { 0x13001f69, 0x2400fff8 },
-  { 0x13001f6a, 0x2400fff8 },
-  { 0x13001f6b, 0x2400fff8 },
-  { 0x13001f6c, 0x2400fff8 },
-  { 0x13001f6d, 0x2400fff8 },
-  { 0x13001f6e, 0x2400fff8 },
-  { 0x13001f6f, 0x2400fff8 },
-  { 0x13001f70, 0x1400004a },
-  { 0x13001f71, 0x1400004a },
-  { 0x13001f72, 0x14000056 },
-  { 0x13001f73, 0x14000056 },
-  { 0x13001f74, 0x14000056 },
-  { 0x13001f75, 0x14000056 },
-  { 0x13001f76, 0x14000064 },
-  { 0x13001f77, 0x14000064 },
-  { 0x13001f78, 0x14000080 },
-  { 0x13001f79, 0x14000080 },
-  { 0x13001f7a, 0x14000070 },
-  { 0x13001f7b, 0x14000070 },
-  { 0x13001f7c, 0x1400007e },
-  { 0x13001f7d, 0x1400007e },
-  { 0x13001f80, 0x14000008 },
-  { 0x13001f81, 0x14000008 },
-  { 0x13001f82, 0x14000008 },
-  { 0x13001f83, 0x14000008 },
-  { 0x13001f84, 0x14000008 },
-  { 0x13001f85, 0x14000008 },
-  { 0x13001f86, 0x14000008 },
-  { 0x13001f87, 0x14000008 },
-  { 0x13001f88, 0x2000fff8 },
-  { 0x13001f89, 0x2000fff8 },
-  { 0x13001f8a, 0x2000fff8 },
-  { 0x13001f8b, 0x2000fff8 },
-  { 0x13001f8c, 0x2000fff8 },
-  { 0x13001f8d, 0x2000fff8 },
-  { 0x13001f8e, 0x2000fff8 },
-  { 0x13001f8f, 0x2000fff8 },
-  { 0x13001f90, 0x14000008 },
-  { 0x13001f91, 0x14000008 },
-  { 0x13001f92, 0x14000008 },
-  { 0x13001f93, 0x14000008 },
-  { 0x13001f94, 0x14000008 },
-  { 0x13001f95, 0x14000008 },
-  { 0x13001f96, 0x14000008 },
-  { 0x13001f97, 0x14000008 },
-  { 0x13001f98, 0x2000fff8 },
-  { 0x13001f99, 0x2000fff8 },
-  { 0x13001f9a, 0x2000fff8 },
-  { 0x13001f9b, 0x2000fff8 },
-  { 0x13001f9c, 0x2000fff8 },
-  { 0x13001f9d, 0x2000fff8 },
-  { 0x13001f9e, 0x2000fff8 },
-  { 0x13001f9f, 0x2000fff8 },
-  { 0x13001fa0, 0x14000008 },
-  { 0x13001fa1, 0x14000008 },
-  { 0x13001fa2, 0x14000008 },
-  { 0x13001fa3, 0x14000008 },
-  { 0x13001fa4, 0x14000008 },
-  { 0x13001fa5, 0x14000008 },
-  { 0x13001fa6, 0x14000008 },
-  { 0x13001fa7, 0x14000008 },
-  { 0x13001fa8, 0x2000fff8 },
-  { 0x13001fa9, 0x2000fff8 },
-  { 0x13001faa, 0x2000fff8 },
-  { 0x13001fab, 0x2000fff8 },
-  { 0x13001fac, 0x2000fff8 },
-  { 0x13001fad, 0x2000fff8 },
-  { 0x13001fae, 0x2000fff8 },
-  { 0x13001faf, 0x2000fff8 },
-  { 0x13001fb0, 0x14000008 },
-  { 0x13001fb1, 0x14000008 },
-  { 0x13001fb2, 0x14000000 },
-  { 0x13001fb3, 0x14000009 },
-  { 0x13001fb4, 0x14000000 },
-  { 0x13801fb6, 0x14000001 },
-  { 0x13001fb8, 0x2400fff8 },
-  { 0x13001fb9, 0x2400fff8 },
-  { 0x13001fba, 0x2400ffb6 },
-  { 0x13001fbb, 0x2400ffb6 },
-  { 0x13001fbc, 0x2000fff7 },
-  { 0x13001fbd, 0x60000000 },
-  { 0x13001fbe, 0x1400e3db },
-  { 0x13801fbf, 0x60000002 },
-  { 0x13001fc2, 0x14000000 },
-  { 0x13001fc3, 0x14000009 },
-  { 0x13001fc4, 0x14000000 },
-  { 0x13801fc6, 0x14000001 },
-  { 0x13001fc8, 0x2400ffaa },
-  { 0x13001fc9, 0x2400ffaa },
-  { 0x13001fca, 0x2400ffaa },
-  { 0x13001fcb, 0x2400ffaa },
-  { 0x13001fcc, 0x2000fff7 },
-  { 0x13801fcd, 0x60000002 },
-  { 0x13001fd0, 0x14000008 },
-  { 0x13001fd1, 0x14000008 },
-  { 0x13801fd2, 0x14000001 },
-  { 0x13801fd6, 0x14000001 },
-  { 0x13001fd8, 0x2400fff8 },
-  { 0x13001fd9, 0x2400fff8 },
-  { 0x13001fda, 0x2400ff9c },
-  { 0x13001fdb, 0x2400ff9c },
-  { 0x13801fdd, 0x60000002 },
-  { 0x13001fe0, 0x14000008 },
-  { 0x13001fe1, 0x14000008 },
-  { 0x13801fe2, 0x14000002 },
-  { 0x13001fe5, 0x14000007 },
-  { 0x13801fe6, 0x14000001 },
-  { 0x13001fe8, 0x2400fff8 },
-  { 0x13001fe9, 0x2400fff8 },
-  { 0x13001fea, 0x2400ff90 },
-  { 0x13001feb, 0x2400ff90 },
-  { 0x13001fec, 0x2400fff9 },
-  { 0x13801fed, 0x60000002 },
-  { 0x13001ff2, 0x14000000 },
-  { 0x13001ff3, 0x14000009 },
-  { 0x13001ff4, 0x14000000 },
-  { 0x13801ff6, 0x14000001 },
-  { 0x13001ff8, 0x2400ff80 },
-  { 0x13001ff9, 0x2400ff80 },
-  { 0x13001ffa, 0x2400ff82 },
-  { 0x13001ffb, 0x2400ff82 },
-  { 0x13001ffc, 0x2000fff7 },
-  { 0x13801ffd, 0x60000001 },
-  { 0x09802000, 0x7400000a },
-  { 0x0980200b, 0x04000004 },
-  { 0x09802010, 0x44000005 },
-  { 0x09802016, 0x54000001 },
-  { 0x09002018, 0x50000000 },
-  { 0x09002019, 0x4c000000 },
-  { 0x0900201a, 0x58000000 },
-  { 0x0980201b, 0x50000001 },
-  { 0x0900201d, 0x4c000000 },
-  { 0x0900201e, 0x58000000 },
-  { 0x0900201f, 0x50000000 },
-  { 0x09802020, 0x54000007 },
-  { 0x09002028, 0x6c000000 },
-  { 0x09002029, 0x70000000 },
-  { 0x0980202a, 0x04000004 },
-  { 0x0900202f, 0x74000000 },
-  { 0x09802030, 0x54000008 },
-  { 0x09002039, 0x50000000 },
-  { 0x0900203a, 0x4c000000 },
-  { 0x0980203b, 0x54000003 },
-  { 0x0980203f, 0x40000001 },
-  { 0x09802041, 0x54000002 },
-  { 0x09002044, 0x64000000 },
-  { 0x09002045, 0x58000000 },
-  { 0x09002046, 0x48000000 },
-  { 0x09802047, 0x5400000a },
-  { 0x09002052, 0x64000000 },
-  { 0x09002053, 0x54000000 },
-  { 0x09002054, 0x40000000 },
-  { 0x09802055, 0x54000009 },
-  { 0x0900205f, 0x74000000 },
-  { 0x09802060, 0x04000003 },
-  { 0x0980206a, 0x04000005 },
-  { 0x09002070, 0x3c000000 },
-  { 0x21002071, 0x14000000 },
-  { 0x09802074, 0x3c000005 },
-  { 0x0980207a, 0x64000002 },
-  { 0x0900207d, 0x58000000 },
-  { 0x0900207e, 0x48000000 },
-  { 0x2100207f, 0x14000000 },
-  { 0x09802080, 0x3c000009 },
-  { 0x0980208a, 0x64000002 },
-  { 0x0900208d, 0x58000000 },
-  { 0x0900208e, 0x48000000 },
-  { 0x21802090, 0x18000004 },
-  { 0x098020a0, 0x5c000015 },
-  { 0x1b8020d0, 0x3000000c },
-  { 0x1b8020dd, 0x2c000003 },
-  { 0x1b0020e1, 0x30000000 },
-  { 0x1b8020e2, 0x2c000002 },
-  { 0x1b8020e5, 0x30000006 },
-  { 0x09802100, 0x68000001 },
-  { 0x09002102, 0x24000000 },
-  { 0x09802103, 0x68000003 },
-  { 0x09002107, 0x24000000 },
-  { 0x09802108, 0x68000001 },
-  { 0x0900210a, 0x14000000 },
-  { 0x0980210b, 0x24000002 },
-  { 0x0980210e, 0x14000001 },
-  { 0x09802110, 0x24000002 },
-  { 0x09002113, 0x14000000 },
-  { 0x09002114, 0x68000000 },
-  { 0x09002115, 0x24000000 },
-  { 0x09802116, 0x68000002 },
-  { 0x09802119, 0x24000004 },
-  { 0x0980211e, 0x68000005 },
-  { 0x09002124, 0x24000000 },
-  { 0x09002125, 0x68000000 },
-  { 0x13002126, 0x2400e2a3 },
-  { 0x09002127, 0x68000000 },
-  { 0x09002128, 0x24000000 },
-  { 0x09002129, 0x68000000 },
-  { 0x2100212a, 0x2400df41 },
-  { 0x2100212b, 0x2400dfba },
-  { 0x0980212c, 0x24000001 },
-  { 0x0900212e, 0x68000000 },
-  { 0x0900212f, 0x14000000 },
-  { 0x09802130, 0x24000001 },
-  { 0x09002132, 0x68000000 },
-  { 0x09002133, 0x24000000 },
-  { 0x09002134, 0x14000000 },
-  { 0x09802135, 0x1c000003 },
-  { 0x09002139, 0x14000000 },
-  { 0x0980213a, 0x68000001 },
-  { 0x0980213c, 0x14000001 },
-  { 0x0980213e, 0x24000001 },
-  { 0x09802140, 0x64000004 },
-  { 0x09002145, 0x24000000 },
-  { 0x09802146, 0x14000003 },
-  { 0x0900214a, 0x68000000 },
-  { 0x0900214b, 0x64000000 },
-  { 0x0900214c, 0x68000000 },
-  { 0x09802153, 0x3c00000c },
-  { 0x09002160, 0x38000010 },
-  { 0x09002161, 0x38000010 },
-  { 0x09002162, 0x38000010 },
-  { 0x09002163, 0x38000010 },
-  { 0x09002164, 0x38000010 },
-  { 0x09002165, 0x38000010 },
-  { 0x09002166, 0x38000010 },
-  { 0x09002167, 0x38000010 },
-  { 0x09002168, 0x38000010 },
-  { 0x09002169, 0x38000010 },
-  { 0x0900216a, 0x38000010 },
-  { 0x0900216b, 0x38000010 },
-  { 0x0900216c, 0x38000010 },
-  { 0x0900216d, 0x38000010 },
-  { 0x0900216e, 0x38000010 },
-  { 0x0900216f, 0x38000010 },
-  { 0x09002170, 0x3800fff0 },
-  { 0x09002171, 0x3800fff0 },
-  { 0x09002172, 0x3800fff0 },
-  { 0x09002173, 0x3800fff0 },
-  { 0x09002174, 0x3800fff0 },
-  { 0x09002175, 0x3800fff0 },
-  { 0x09002176, 0x3800fff0 },
-  { 0x09002177, 0x3800fff0 },
-  { 0x09002178, 0x3800fff0 },
-  { 0x09002179, 0x3800fff0 },
-  { 0x0900217a, 0x3800fff0 },
-  { 0x0900217b, 0x3800fff0 },
-  { 0x0900217c, 0x3800fff0 },
-  { 0x0900217d, 0x3800fff0 },
-  { 0x0900217e, 0x3800fff0 },
-  { 0x0900217f, 0x3800fff0 },
-  { 0x09802180, 0x38000003 },
-  { 0x09802190, 0x64000004 },
-  { 0x09802195, 0x68000004 },
-  { 0x0980219a, 0x64000001 },
-  { 0x0980219c, 0x68000003 },
-  { 0x090021a0, 0x64000000 },
-  { 0x098021a1, 0x68000001 },
-  { 0x090021a3, 0x64000000 },
-  { 0x098021a4, 0x68000001 },
-  { 0x090021a6, 0x64000000 },
-  { 0x098021a7, 0x68000006 },
-  { 0x090021ae, 0x64000000 },
-  { 0x098021af, 0x6800001e },
-  { 0x098021ce, 0x64000001 },
-  { 0x098021d0, 0x68000001 },
-  { 0x090021d2, 0x64000000 },
-  { 0x090021d3, 0x68000000 },
-  { 0x090021d4, 0x64000000 },
-  { 0x098021d5, 0x6800001e },
-  { 0x098021f4, 0x6400010b },
-  { 0x09802300, 0x68000007 },
-  { 0x09802308, 0x64000003 },
-  { 0x0980230c, 0x68000013 },
-  { 0x09802320, 0x64000001 },
-  { 0x09802322, 0x68000006 },
-  { 0x09002329, 0x58000000 },
-  { 0x0900232a, 0x48000000 },
-  { 0x0980232b, 0x68000050 },
-  { 0x0900237c, 0x64000000 },
-  { 0x0980237d, 0x6800001d },
-  { 0x0980239b, 0x64000018 },
-  { 0x090023b4, 0x58000000 },
-  { 0x090023b5, 0x48000000 },
-  { 0x090023b6, 0x54000000 },
-  { 0x098023b7, 0x68000024 },
-  { 0x09802400, 0x68000026 },
-  { 0x09802440, 0x6800000a },
-  { 0x09802460, 0x3c00003b },
-  { 0x0980249c, 0x68000019 },
-  { 0x090024b6, 0x6800001a },
-  { 0x090024b7, 0x6800001a },
-  { 0x090024b8, 0x6800001a },
-  { 0x090024b9, 0x6800001a },
-  { 0x090024ba, 0x6800001a },
-  { 0x090024bb, 0x6800001a },
-  { 0x090024bc, 0x6800001a },
-  { 0x090024bd, 0x6800001a },
-  { 0x090024be, 0x6800001a },
-  { 0x090024bf, 0x6800001a },
-  { 0x090024c0, 0x6800001a },
-  { 0x090024c1, 0x6800001a },
-  { 0x090024c2, 0x6800001a },
-  { 0x090024c3, 0x6800001a },
-  { 0x090024c4, 0x6800001a },
-  { 0x090024c5, 0x6800001a },
-  { 0x090024c6, 0x6800001a },
-  { 0x090024c7, 0x6800001a },
-  { 0x090024c8, 0x6800001a },
-  { 0x090024c9, 0x6800001a },
-  { 0x090024ca, 0x6800001a },
-  { 0x090024cb, 0x6800001a },
-  { 0x090024cc, 0x6800001a },
-  { 0x090024cd, 0x6800001a },
-  { 0x090024ce, 0x6800001a },
-  { 0x090024cf, 0x6800001a },
-  { 0x090024d0, 0x6800ffe6 },
-  { 0x090024d1, 0x6800ffe6 },
-  { 0x090024d2, 0x6800ffe6 },
-  { 0x090024d3, 0x6800ffe6 },
-  { 0x090024d4, 0x6800ffe6 },
-  { 0x090024d5, 0x6800ffe6 },
-  { 0x090024d6, 0x6800ffe6 },
-  { 0x090024d7, 0x6800ffe6 },
-  { 0x090024d8, 0x6800ffe6 },
-  { 0x090024d9, 0x6800ffe6 },
-  { 0x090024da, 0x6800ffe6 },
-  { 0x090024db, 0x6800ffe6 },
-  { 0x090024dc, 0x6800ffe6 },
-  { 0x090024dd, 0x6800ffe6 },
-  { 0x090024de, 0x6800ffe6 },
-  { 0x090024df, 0x6800ffe6 },
-  { 0x090024e0, 0x6800ffe6 },
-  { 0x090024e1, 0x6800ffe6 },
-  { 0x090024e2, 0x6800ffe6 },
-  { 0x090024e3, 0x6800ffe6 },
-  { 0x090024e4, 0x6800ffe6 },
-  { 0x090024e5, 0x6800ffe6 },
-  { 0x090024e6, 0x6800ffe6 },
-  { 0x090024e7, 0x6800ffe6 },
-  { 0x090024e8, 0x6800ffe6 },
-  { 0x090024e9, 0x6800ffe6 },
-  { 0x098024ea, 0x3c000015 },
-  { 0x09802500, 0x680000b6 },
-  { 0x090025b7, 0x64000000 },
-  { 0x098025b8, 0x68000008 },
-  { 0x090025c1, 0x64000000 },
-  { 0x098025c2, 0x68000035 },
-  { 0x098025f8, 0x64000007 },
-  { 0x09802600, 0x6800006e },
-  { 0x0900266f, 0x64000000 },
-  { 0x09802670, 0x6800002c },
-  { 0x098026a0, 0x68000011 },
-  { 0x09802701, 0x68000003 },
-  { 0x09802706, 0x68000003 },
-  { 0x0980270c, 0x6800001b },
-  { 0x09802729, 0x68000022 },
-  { 0x0900274d, 0x68000000 },
-  { 0x0980274f, 0x68000003 },
-  { 0x09002756, 0x68000000 },
-  { 0x09802758, 0x68000006 },
-  { 0x09802761, 0x68000006 },
-  { 0x09002768, 0x58000000 },
-  { 0x09002769, 0x48000000 },
-  { 0x0900276a, 0x58000000 },
-  { 0x0900276b, 0x48000000 },
-  { 0x0900276c, 0x58000000 },
-  { 0x0900276d, 0x48000000 },
-  { 0x0900276e, 0x58000000 },
-  { 0x0900276f, 0x48000000 },
-  { 0x09002770, 0x58000000 },
-  { 0x09002771, 0x48000000 },
-  { 0x09002772, 0x58000000 },
-  { 0x09002773, 0x48000000 },
-  { 0x09002774, 0x58000000 },
-  { 0x09002775, 0x48000000 },
-  { 0x09802776, 0x3c00001d },
-  { 0x09002794, 0x68000000 },
-  { 0x09802798, 0x68000017 },
-  { 0x098027b1, 0x6800000d },
-  { 0x098027c0, 0x64000004 },
-  { 0x090027c5, 0x58000000 },
-  { 0x090027c6, 0x48000000 },
-  { 0x098027d0, 0x64000015 },
-  { 0x090027e6, 0x58000000 },
-  { 0x090027e7, 0x48000000 },
-  { 0x090027e8, 0x58000000 },
-  { 0x090027e9, 0x48000000 },
-  { 0x090027ea, 0x58000000 },
-  { 0x090027eb, 0x48000000 },
-  { 0x098027f0, 0x6400000f },
-  { 0x04802800, 0x680000ff },
-  { 0x09802900, 0x64000082 },
-  { 0x09002983, 0x58000000 },
-  { 0x09002984, 0x48000000 },
-  { 0x09002985, 0x58000000 },
-  { 0x09002986, 0x48000000 },
-  { 0x09002987, 0x58000000 },
-  { 0x09002988, 0x48000000 },
-  { 0x09002989, 0x58000000 },
-  { 0x0900298a, 0x48000000 },
-  { 0x0900298b, 0x58000000 },
-  { 0x0900298c, 0x48000000 },
-  { 0x0900298d, 0x58000000 },
-  { 0x0900298e, 0x48000000 },
-  { 0x0900298f, 0x58000000 },
-  { 0x09002990, 0x48000000 },
-  { 0x09002991, 0x58000000 },
-  { 0x09002992, 0x48000000 },
-  { 0x09002993, 0x58000000 },
-  { 0x09002994, 0x48000000 },
-  { 0x09002995, 0x58000000 },
-  { 0x09002996, 0x48000000 },
-  { 0x09002997, 0x58000000 },
-  { 0x09002998, 0x48000000 },
-  { 0x09802999, 0x6400003e },
-  { 0x090029d8, 0x58000000 },
-  { 0x090029d9, 0x48000000 },
-  { 0x090029da, 0x58000000 },
-  { 0x090029db, 0x48000000 },
-  { 0x098029dc, 0x6400001f },
-  { 0x090029fc, 0x58000000 },
-  { 0x090029fd, 0x48000000 },
-  { 0x098029fe, 0x64000101 },
-  { 0x09802b00, 0x68000013 },
-  { 0x11002c00, 0x24000030 },
-  { 0x11002c01, 0x24000030 },
-  { 0x11002c02, 0x24000030 },
-  { 0x11002c03, 0x24000030 },
-  { 0x11002c04, 0x24000030 },
-  { 0x11002c05, 0x24000030 },
-  { 0x11002c06, 0x24000030 },
-  { 0x11002c07, 0x24000030 },
-  { 0x11002c08, 0x24000030 },
-  { 0x11002c09, 0x24000030 },
-  { 0x11002c0a, 0x24000030 },
-  { 0x11002c0b, 0x24000030 },
-  { 0x11002c0c, 0x24000030 },
-  { 0x11002c0d, 0x24000030 },
-  { 0x11002c0e, 0x24000030 },
-  { 0x11002c0f, 0x24000030 },
-  { 0x11002c10, 0x24000030 },
-  { 0x11002c11, 0x24000030 },
-  { 0x11002c12, 0x24000030 },
-  { 0x11002c13, 0x24000030 },
-  { 0x11002c14, 0x24000030 },
-  { 0x11002c15, 0x24000030 },
-  { 0x11002c16, 0x24000030 },
-  { 0x11002c17, 0x24000030 },
-  { 0x11002c18, 0x24000030 },
-  { 0x11002c19, 0x24000030 },
-  { 0x11002c1a, 0x24000030 },
-  { 0x11002c1b, 0x24000030 },
-  { 0x11002c1c, 0x24000030 },
-  { 0x11002c1d, 0x24000030 },
-  { 0x11002c1e, 0x24000030 },
-  { 0x11002c1f, 0x24000030 },
-  { 0x11002c20, 0x24000030 },
-  { 0x11002c21, 0x24000030 },
-  { 0x11002c22, 0x24000030 },
-  { 0x11002c23, 0x24000030 },
-  { 0x11002c24, 0x24000030 },
-  { 0x11002c25, 0x24000030 },
-  { 0x11002c26, 0x24000030 },
-  { 0x11002c27, 0x24000030 },
-  { 0x11002c28, 0x24000030 },
-  { 0x11002c29, 0x24000030 },
-  { 0x11002c2a, 0x24000030 },
-  { 0x11002c2b, 0x24000030 },
-  { 0x11002c2c, 0x24000030 },
-  { 0x11002c2d, 0x24000030 },
-  { 0x11002c2e, 0x24000030 },
-  { 0x11002c30, 0x1400ffd0 },
-  { 0x11002c31, 0x1400ffd0 },
-  { 0x11002c32, 0x1400ffd0 },
-  { 0x11002c33, 0x1400ffd0 },
-  { 0x11002c34, 0x1400ffd0 },
-  { 0x11002c35, 0x1400ffd0 },
-  { 0x11002c36, 0x1400ffd0 },
-  { 0x11002c37, 0x1400ffd0 },
-  { 0x11002c38, 0x1400ffd0 },
-  { 0x11002c39, 0x1400ffd0 },
-  { 0x11002c3a, 0x1400ffd0 },
-  { 0x11002c3b, 0x1400ffd0 },
-  { 0x11002c3c, 0x1400ffd0 },
-  { 0x11002c3d, 0x1400ffd0 },
-  { 0x11002c3e, 0x1400ffd0 },
-  { 0x11002c3f, 0x1400ffd0 },
-  { 0x11002c40, 0x1400ffd0 },
-  { 0x11002c41, 0x1400ffd0 },
-  { 0x11002c42, 0x1400ffd0 },
-  { 0x11002c43, 0x1400ffd0 },
-  { 0x11002c44, 0x1400ffd0 },
-  { 0x11002c45, 0x1400ffd0 },
-  { 0x11002c46, 0x1400ffd0 },
-  { 0x11002c47, 0x1400ffd0 },
-  { 0x11002c48, 0x1400ffd0 },
-  { 0x11002c49, 0x1400ffd0 },
-  { 0x11002c4a, 0x1400ffd0 },
-  { 0x11002c4b, 0x1400ffd0 },
-  { 0x11002c4c, 0x1400ffd0 },
-  { 0x11002c4d, 0x1400ffd0 },
-  { 0x11002c4e, 0x1400ffd0 },
-  { 0x11002c4f, 0x1400ffd0 },
-  { 0x11002c50, 0x1400ffd0 },
-  { 0x11002c51, 0x1400ffd0 },
-  { 0x11002c52, 0x1400ffd0 },
-  { 0x11002c53, 0x1400ffd0 },
-  { 0x11002c54, 0x1400ffd0 },
-  { 0x11002c55, 0x1400ffd0 },
-  { 0x11002c56, 0x1400ffd0 },
-  { 0x11002c57, 0x1400ffd0 },
-  { 0x11002c58, 0x1400ffd0 },
-  { 0x11002c59, 0x1400ffd0 },
-  { 0x11002c5a, 0x1400ffd0 },
-  { 0x11002c5b, 0x1400ffd0 },
-  { 0x11002c5c, 0x1400ffd0 },
-  { 0x11002c5d, 0x1400ffd0 },
-  { 0x11002c5e, 0x1400ffd0 },
-  { 0x0a002c80, 0x24000001 },
-  { 0x0a002c81, 0x1400ffff },
-  { 0x0a002c82, 0x24000001 },
-  { 0x0a002c83, 0x1400ffff },
-  { 0x0a002c84, 0x24000001 },
-  { 0x0a002c85, 0x1400ffff },
-  { 0x0a002c86, 0x24000001 },
-  { 0x0a002c87, 0x1400ffff },
-  { 0x0a002c88, 0x24000001 },
-  { 0x0a002c89, 0x1400ffff },
-  { 0x0a002c8a, 0x24000001 },
-  { 0x0a002c8b, 0x1400ffff },
-  { 0x0a002c8c, 0x24000001 },
-  { 0x0a002c8d, 0x1400ffff },
-  { 0x0a002c8e, 0x24000001 },
-  { 0x0a002c8f, 0x1400ffff },
-  { 0x0a002c90, 0x24000001 },
-  { 0x0a002c91, 0x1400ffff },
-  { 0x0a002c92, 0x24000001 },
-  { 0x0a002c93, 0x1400ffff },
-  { 0x0a002c94, 0x24000001 },
-  { 0x0a002c95, 0x1400ffff },
-  { 0x0a002c96, 0x24000001 },
-  { 0x0a002c97, 0x1400ffff },
-  { 0x0a002c98, 0x24000001 },
-  { 0x0a002c99, 0x1400ffff },
-  { 0x0a002c9a, 0x24000001 },
-  { 0x0a002c9b, 0x1400ffff },
-  { 0x0a002c9c, 0x24000001 },
-  { 0x0a002c9d, 0x1400ffff },
-  { 0x0a002c9e, 0x24000001 },
-  { 0x0a002c9f, 0x1400ffff },
-  { 0x0a002ca0, 0x24000001 },
-  { 0x0a002ca1, 0x1400ffff },
-  { 0x0a002ca2, 0x24000001 },
-  { 0x0a002ca3, 0x1400ffff },
-  { 0x0a002ca4, 0x24000001 },
-  { 0x0a002ca5, 0x1400ffff },
-  { 0x0a002ca6, 0x24000001 },
-  { 0x0a002ca7, 0x1400ffff },
-  { 0x0a002ca8, 0x24000001 },
-  { 0x0a002ca9, 0x1400ffff },
-  { 0x0a002caa, 0x24000001 },
-  { 0x0a002cab, 0x1400ffff },
-  { 0x0a002cac, 0x24000001 },
-  { 0x0a002cad, 0x1400ffff },
-  { 0x0a002cae, 0x24000001 },
-  { 0x0a002caf, 0x1400ffff },
-  { 0x0a002cb0, 0x24000001 },
-  { 0x0a002cb1, 0x1400ffff },
-  { 0x0a002cb2, 0x24000001 },
-  { 0x0a002cb3, 0x1400ffff },
-  { 0x0a002cb4, 0x24000001 },
-  { 0x0a002cb5, 0x1400ffff },
-  { 0x0a002cb6, 0x24000001 },
-  { 0x0a002cb7, 0x1400ffff },
-  { 0x0a002cb8, 0x24000001 },
-  { 0x0a002cb9, 0x1400ffff },
-  { 0x0a002cba, 0x24000001 },
-  { 0x0a002cbb, 0x1400ffff },
-  { 0x0a002cbc, 0x24000001 },
-  { 0x0a002cbd, 0x1400ffff },
-  { 0x0a002cbe, 0x24000001 },
-  { 0x0a002cbf, 0x1400ffff },
-  { 0x0a002cc0, 0x24000001 },
-  { 0x0a002cc1, 0x1400ffff },
-  { 0x0a002cc2, 0x24000001 },
-  { 0x0a002cc3, 0x1400ffff },
-  { 0x0a002cc4, 0x24000001 },
-  { 0x0a002cc5, 0x1400ffff },
-  { 0x0a002cc6, 0x24000001 },
-  { 0x0a002cc7, 0x1400ffff },
-  { 0x0a002cc8, 0x24000001 },
-  { 0x0a002cc9, 0x1400ffff },
-  { 0x0a002cca, 0x24000001 },
-  { 0x0a002ccb, 0x1400ffff },
-  { 0x0a002ccc, 0x24000001 },
-  { 0x0a002ccd, 0x1400ffff },
-  { 0x0a002cce, 0x24000001 },
-  { 0x0a002ccf, 0x1400ffff },
-  { 0x0a002cd0, 0x24000001 },
-  { 0x0a002cd1, 0x1400ffff },
-  { 0x0a002cd2, 0x24000001 },
-  { 0x0a002cd3, 0x1400ffff },
-  { 0x0a002cd4, 0x24000001 },
-  { 0x0a002cd5, 0x1400ffff },
-  { 0x0a002cd6, 0x24000001 },
-  { 0x0a002cd7, 0x1400ffff },
-  { 0x0a002cd8, 0x24000001 },
-  { 0x0a002cd9, 0x1400ffff },
-  { 0x0a002cda, 0x24000001 },
-  { 0x0a002cdb, 0x1400ffff },
-  { 0x0a002cdc, 0x24000001 },
-  { 0x0a002cdd, 0x1400ffff },
-  { 0x0a002cde, 0x24000001 },
-  { 0x0a002cdf, 0x1400ffff },
-  { 0x0a002ce0, 0x24000001 },
-  { 0x0a002ce1, 0x1400ffff },
-  { 0x0a002ce2, 0x24000001 },
-  { 0x0a002ce3, 0x1400ffff },
-  { 0x0a002ce4, 0x14000000 },
-  { 0x0a802ce5, 0x68000005 },
-  { 0x0a802cf9, 0x54000003 },
-  { 0x0a002cfd, 0x3c000000 },
-  { 0x0a802cfe, 0x54000001 },
-  { 0x10002d00, 0x1400e3a0 },
-  { 0x10002d01, 0x1400e3a0 },
-  { 0x10002d02, 0x1400e3a0 },
-  { 0x10002d03, 0x1400e3a0 },
-  { 0x10002d04, 0x1400e3a0 },
-  { 0x10002d05, 0x1400e3a0 },
-  { 0x10002d06, 0x1400e3a0 },
-  { 0x10002d07, 0x1400e3a0 },
-  { 0x10002d08, 0x1400e3a0 },
-  { 0x10002d09, 0x1400e3a0 },
-  { 0x10002d0a, 0x1400e3a0 },
-  { 0x10002d0b, 0x1400e3a0 },
-  { 0x10002d0c, 0x1400e3a0 },
-  { 0x10002d0d, 0x1400e3a0 },
-  { 0x10002d0e, 0x1400e3a0 },
-  { 0x10002d0f, 0x1400e3a0 },
-  { 0x10002d10, 0x1400e3a0 },
-  { 0x10002d11, 0x1400e3a0 },
-  { 0x10002d12, 0x1400e3a0 },
-  { 0x10002d13, 0x1400e3a0 },
-  { 0x10002d14, 0x1400e3a0 },
-  { 0x10002d15, 0x1400e3a0 },
-  { 0x10002d16, 0x1400e3a0 },
-  { 0x10002d17, 0x1400e3a0 },
-  { 0x10002d18, 0x1400e3a0 },
-  { 0x10002d19, 0x1400e3a0 },
-  { 0x10002d1a, 0x1400e3a0 },
-  { 0x10002d1b, 0x1400e3a0 },
-  { 0x10002d1c, 0x1400e3a0 },
-  { 0x10002d1d, 0x1400e3a0 },
-  { 0x10002d1e, 0x1400e3a0 },
-  { 0x10002d1f, 0x1400e3a0 },
-  { 0x10002d20, 0x1400e3a0 },
-  { 0x10002d21, 0x1400e3a0 },
-  { 0x10002d22, 0x1400e3a0 },
-  { 0x10002d23, 0x1400e3a0 },
-  { 0x10002d24, 0x1400e3a0 },
-  { 0x10002d25, 0x1400e3a0 },
-  { 0x3a802d30, 0x1c000035 },
-  { 0x3a002d6f, 0x18000000 },
-  { 0x0f802d80, 0x1c000016 },
-  { 0x0f802da0, 0x1c000006 },
-  { 0x0f802da8, 0x1c000006 },
-  { 0x0f802db0, 0x1c000006 },
-  { 0x0f802db8, 0x1c000006 },
-  { 0x0f802dc0, 0x1c000006 },
-  { 0x0f802dc8, 0x1c000006 },
-  { 0x0f802dd0, 0x1c000006 },
-  { 0x0f802dd8, 0x1c000006 },
-  { 0x09802e00, 0x54000001 },
-  { 0x09002e02, 0x50000000 },
-  { 0x09002e03, 0x4c000000 },
-  { 0x09002e04, 0x50000000 },
-  { 0x09002e05, 0x4c000000 },
-  { 0x09802e06, 0x54000002 },
-  { 0x09002e09, 0x50000000 },
-  { 0x09002e0a, 0x4c000000 },
-  { 0x09002e0b, 0x54000000 },
-  { 0x09002e0c, 0x50000000 },
-  { 0x09002e0d, 0x4c000000 },
-  { 0x09802e0e, 0x54000008 },
-  { 0x09002e17, 0x44000000 },
-  { 0x09002e1c, 0x50000000 },
-  { 0x09002e1d, 0x4c000000 },
-  { 0x16802e80, 0x68000019 },
-  { 0x16802e9b, 0x68000058 },
-  { 0x16802f00, 0x680000d5 },
-  { 0x09802ff0, 0x6800000b },
-  { 0x09003000, 0x74000000 },
-  { 0x09803001, 0x54000002 },
-  { 0x09003004, 0x68000000 },
-  { 0x16003005, 0x18000000 },
-  { 0x09003006, 0x1c000000 },
-  { 0x16003007, 0x38000000 },
-  { 0x09003008, 0x58000000 },
-  { 0x09003009, 0x48000000 },
-  { 0x0900300a, 0x58000000 },
-  { 0x0900300b, 0x48000000 },
-  { 0x0900300c, 0x58000000 },
-  { 0x0900300d, 0x48000000 },
-  { 0x0900300e, 0x58000000 },
-  { 0x0900300f, 0x48000000 },
-  { 0x09003010, 0x58000000 },
-  { 0x09003011, 0x48000000 },
-  { 0x09803012, 0x68000001 },
-  { 0x09003014, 0x58000000 },
-  { 0x09003015, 0x48000000 },
-  { 0x09003016, 0x58000000 },
-  { 0x09003017, 0x48000000 },
-  { 0x09003018, 0x58000000 },
-  { 0x09003019, 0x48000000 },
-  { 0x0900301a, 0x58000000 },
-  { 0x0900301b, 0x48000000 },
-  { 0x0900301c, 0x44000000 },
-  { 0x0900301d, 0x58000000 },
-  { 0x0980301e, 0x48000001 },
-  { 0x09003020, 0x68000000 },
-  { 0x16803021, 0x38000008 },
-  { 0x1b80302a, 0x30000005 },
-  { 0x09003030, 0x44000000 },
-  { 0x09803031, 0x18000004 },
-  { 0x09803036, 0x68000001 },
-  { 0x16803038, 0x38000002 },
-  { 0x1600303b, 0x18000000 },
-  { 0x0900303c, 0x1c000000 },
-  { 0x0900303d, 0x54000000 },
-  { 0x0980303e, 0x68000001 },
-  { 0x1a803041, 0x1c000055 },
-  { 0x1b803099, 0x30000001 },
-  { 0x0980309b, 0x60000001 },
-  { 0x1a80309d, 0x18000001 },
-  { 0x1a00309f, 0x1c000000 },
-  { 0x090030a0, 0x44000000 },
-  { 0x1d8030a1, 0x1c000059 },
-  { 0x090030fb, 0x54000000 },
-  { 0x098030fc, 0x18000002 },
-  { 0x1d0030ff, 0x1c000000 },
-  { 0x03803105, 0x1c000027 },
-  { 0x17803131, 0x1c00005d },
-  { 0x09803190, 0x68000001 },
-  { 0x09803192, 0x3c000003 },
-  { 0x09803196, 0x68000009 },
-  { 0x038031a0, 0x1c000017 },
-  { 0x098031c0, 0x6800000f },
-  { 0x1d8031f0, 0x1c00000f },
-  { 0x17803200, 0x6800001e },
-  { 0x09803220, 0x3c000009 },
-  { 0x0980322a, 0x68000019 },
-  { 0x09003250, 0x68000000 },
-  { 0x09803251, 0x3c00000e },
-  { 0x17803260, 0x6800001f },
-  { 0x09803280, 0x3c000009 },
-  { 0x0980328a, 0x68000026 },
-  { 0x098032b1, 0x3c00000e },
-  { 0x098032c0, 0x6800003e },
-  { 0x09803300, 0x680000ff },
-  { 0x16803400, 0x1c0019b5 },
-  { 0x09804dc0, 0x6800003f },
-  { 0x16804e00, 0x1c0051bb },
-  { 0x3c80a000, 0x1c000014 },
-  { 0x3c00a015, 0x18000000 },
-  { 0x3c80a016, 0x1c000476 },
-  { 0x3c80a490, 0x68000036 },
-  { 0x0980a700, 0x60000016 },
-  { 0x3080a800, 0x1c000001 },
-  { 0x3000a802, 0x28000000 },
-  { 0x3080a803, 0x1c000002 },
-  { 0x3000a806, 0x30000000 },
-  { 0x3080a807, 0x1c000003 },
-  { 0x3000a80b, 0x30000000 },
-  { 0x3080a80c, 0x1c000016 },
-  { 0x3080a823, 0x28000001 },
-  { 0x3080a825, 0x30000001 },
-  { 0x3000a827, 0x28000000 },
-  { 0x3080a828, 0x68000003 },
-  { 0x1780ac00, 0x1c002ba3 },
-  { 0x0980d800, 0x1000037f },
-  { 0x0980db80, 0x1000007f },
-  { 0x0980dc00, 0x100003ff },
-  { 0x0980e000, 0x0c0018ff },
-  { 0x1680f900, 0x1c00012d },
-  { 0x1680fa30, 0x1c00003a },
-  { 0x1680fa70, 0x1c000069 },
-  { 0x2180fb00, 0x14000006 },
-  { 0x0180fb13, 0x14000004 },
-  { 0x1900fb1d, 0x1c000000 },
-  { 0x1900fb1e, 0x30000000 },
-  { 0x1980fb1f, 0x1c000009 },
-  { 0x1900fb29, 0x64000000 },
-  { 0x1980fb2a, 0x1c00000c },
-  { 0x1980fb38, 0x1c000004 },
-  { 0x1900fb3e, 0x1c000000 },
-  { 0x1980fb40, 0x1c000001 },
-  { 0x1980fb43, 0x1c000001 },
-  { 0x1980fb46, 0x1c00006b },
-  { 0x0080fbd3, 0x1c00016a },
-  { 0x0900fd3e, 0x58000000 },
-  { 0x0900fd3f, 0x48000000 },
-  { 0x0080fd50, 0x1c00003f },
-  { 0x0080fd92, 0x1c000035 },
-  { 0x0080fdf0, 0x1c00000b },
-  { 0x0000fdfc, 0x5c000000 },
-  { 0x0900fdfd, 0x68000000 },
-  { 0x1b80fe00, 0x3000000f },
-  { 0x0980fe10, 0x54000006 },
-  { 0x0900fe17, 0x58000000 },
-  { 0x0900fe18, 0x48000000 },
-  { 0x0900fe19, 0x54000000 },
-  { 0x1b80fe20, 0x30000003 },
-  { 0x0900fe30, 0x54000000 },
-  { 0x0980fe31, 0x44000001 },
-  { 0x0980fe33, 0x40000001 },
-  { 0x0900fe35, 0x58000000 },
-  { 0x0900fe36, 0x48000000 },
-  { 0x0900fe37, 0x58000000 },
-  { 0x0900fe38, 0x48000000 },
-  { 0x0900fe39, 0x58000000 },
-  { 0x0900fe3a, 0x48000000 },
-  { 0x0900fe3b, 0x58000000 },
-  { 0x0900fe3c, 0x48000000 },
-  { 0x0900fe3d, 0x58000000 },
-  { 0x0900fe3e, 0x48000000 },
-  { 0x0900fe3f, 0x58000000 },
-  { 0x0900fe40, 0x48000000 },
-  { 0x0900fe41, 0x58000000 },
-  { 0x0900fe42, 0x48000000 },
-  { 0x0900fe43, 0x58000000 },
-  { 0x0900fe44, 0x48000000 },
-  { 0x0980fe45, 0x54000001 },
-  { 0x0900fe47, 0x58000000 },
-  { 0x0900fe48, 0x48000000 },
-  { 0x0980fe49, 0x54000003 },
-  { 0x0980fe4d, 0x40000002 },
-  { 0x0980fe50, 0x54000002 },
-  { 0x0980fe54, 0x54000003 },
-  { 0x0900fe58, 0x44000000 },
-  { 0x0900fe59, 0x58000000 },
-  { 0x0900fe5a, 0x48000000 },
-  { 0x0900fe5b, 0x58000000 },
-  { 0x0900fe5c, 0x48000000 },
-  { 0x0900fe5d, 0x58000000 },
-  { 0x0900fe5e, 0x48000000 },
-  { 0x0980fe5f, 0x54000002 },
-  { 0x0900fe62, 0x64000000 },
-  { 0x0900fe63, 0x44000000 },
-  { 0x0980fe64, 0x64000002 },
-  { 0x0900fe68, 0x54000000 },
-  { 0x0900fe69, 0x5c000000 },
-  { 0x0980fe6a, 0x54000001 },
-  { 0x0080fe70, 0x1c000004 },
-  { 0x0080fe76, 0x1c000086 },
-  { 0x0900feff, 0x04000000 },
-  { 0x0980ff01, 0x54000002 },
-  { 0x0900ff04, 0x5c000000 },
-  { 0x0980ff05, 0x54000002 },
-  { 0x0900ff08, 0x58000000 },
-  { 0x0900ff09, 0x48000000 },
-  { 0x0900ff0a, 0x54000000 },
-  { 0x0900ff0b, 0x64000000 },
-  { 0x0900ff0c, 0x54000000 },
-  { 0x0900ff0d, 0x44000000 },
-  { 0x0980ff0e, 0x54000001 },
-  { 0x0980ff10, 0x34000009 },
-  { 0x0980ff1a, 0x54000001 },
-  { 0x0980ff1c, 0x64000002 },
-  { 0x0980ff1f, 0x54000001 },
-  { 0x2100ff21, 0x24000020 },
-  { 0x2100ff22, 0x24000020 },
-  { 0x2100ff23, 0x24000020 },
-  { 0x2100ff24, 0x24000020 },
-  { 0x2100ff25, 0x24000020 },
-  { 0x2100ff26, 0x24000020 },
-  { 0x2100ff27, 0x24000020 },
-  { 0x2100ff28, 0x24000020 },
-  { 0x2100ff29, 0x24000020 },
-  { 0x2100ff2a, 0x24000020 },
-  { 0x2100ff2b, 0x24000020 },
-  { 0x2100ff2c, 0x24000020 },
-  { 0x2100ff2d, 0x24000020 },
-  { 0x2100ff2e, 0x24000020 },
-  { 0x2100ff2f, 0x24000020 },
-  { 0x2100ff30, 0x24000020 },
-  { 0x2100ff31, 0x24000020 },
-  { 0x2100ff32, 0x24000020 },
-  { 0x2100ff33, 0x24000020 },
-  { 0x2100ff34, 0x24000020 },
-  { 0x2100ff35, 0x24000020 },
-  { 0x2100ff36, 0x24000020 },
-  { 0x2100ff37, 0x24000020 },
-  { 0x2100ff38, 0x24000020 },
-  { 0x2100ff39, 0x24000020 },
-  { 0x2100ff3a, 0x24000020 },
-  { 0x0900ff3b, 0x58000000 },
-  { 0x0900ff3c, 0x54000000 },
-  { 0x0900ff3d, 0x48000000 },
-  { 0x0900ff3e, 0x60000000 },
-  { 0x0900ff3f, 0x40000000 },
-  { 0x0900ff40, 0x60000000 },
-  { 0x2100ff41, 0x1400ffe0 },
-  { 0x2100ff42, 0x1400ffe0 },
-  { 0x2100ff43, 0x1400ffe0 },
-  { 0x2100ff44, 0x1400ffe0 },
-  { 0x2100ff45, 0x1400ffe0 },
-  { 0x2100ff46, 0x1400ffe0 },
-  { 0x2100ff47, 0x1400ffe0 },
-  { 0x2100ff48, 0x1400ffe0 },
-  { 0x2100ff49, 0x1400ffe0 },
-  { 0x2100ff4a, 0x1400ffe0 },
-  { 0x2100ff4b, 0x1400ffe0 },
-  { 0x2100ff4c, 0x1400ffe0 },
-  { 0x2100ff4d, 0x1400ffe0 },
-  { 0x2100ff4e, 0x1400ffe0 },
-  { 0x2100ff4f, 0x1400ffe0 },
-  { 0x2100ff50, 0x1400ffe0 },
-  { 0x2100ff51, 0x1400ffe0 },
-  { 0x2100ff52, 0x1400ffe0 },
-  { 0x2100ff53, 0x1400ffe0 },
-  { 0x2100ff54, 0x1400ffe0 },
-  { 0x2100ff55, 0x1400ffe0 },
-  { 0x2100ff56, 0x1400ffe0 },
-  { 0x2100ff57, 0x1400ffe0 },
-  { 0x2100ff58, 0x1400ffe0 },
-  { 0x2100ff59, 0x1400ffe0 },
-  { 0x2100ff5a, 0x1400ffe0 },
-  { 0x0900ff5b, 0x58000000 },
-  { 0x0900ff5c, 0x64000000 },
-  { 0x0900ff5d, 0x48000000 },
-  { 0x0900ff5e, 0x64000000 },
-  { 0x0900ff5f, 0x58000000 },
-  { 0x0900ff60, 0x48000000 },
-  { 0x0900ff61, 0x54000000 },
-  { 0x0900ff62, 0x58000000 },
-  { 0x0900ff63, 0x48000000 },
-  { 0x0980ff64, 0x54000001 },
-  { 0x1d80ff66, 0x1c000009 },
-  { 0x0900ff70, 0x18000000 },
-  { 0x1d80ff71, 0x1c00002c },
-  { 0x0980ff9e, 0x18000001 },
-  { 0x1780ffa0, 0x1c00001e },
-  { 0x1780ffc2, 0x1c000005 },
-  { 0x1780ffca, 0x1c000005 },
-  { 0x1780ffd2, 0x1c000005 },
-  { 0x1780ffda, 0x1c000002 },
-  { 0x0980ffe0, 0x5c000001 },
-  { 0x0900ffe2, 0x64000000 },
-  { 0x0900ffe3, 0x60000000 },
-  { 0x0900ffe4, 0x68000000 },
-  { 0x0980ffe5, 0x5c000001 },
-  { 0x0900ffe8, 0x68000000 },
-  { 0x0980ffe9, 0x64000003 },
-  { 0x0980ffed, 0x68000001 },
-  { 0x0980fff9, 0x04000002 },
-  { 0x0980fffc, 0x68000001 },
-  { 0x23810000, 0x1c00000b },
-  { 0x2381000d, 0x1c000019 },
-  { 0x23810028, 0x1c000012 },
-  { 0x2381003c, 0x1c000001 },
-  { 0x2381003f, 0x1c00000e },
-  { 0x23810050, 0x1c00000d },
-  { 0x23810080, 0x1c00007a },
-  { 0x09810100, 0x54000001 },
-  { 0x09010102, 0x68000000 },
-  { 0x09810107, 0x3c00002c },
-  { 0x09810137, 0x68000008 },
-  { 0x13810140, 0x38000034 },
-  { 0x13810175, 0x3c000003 },
-  { 0x13810179, 0x68000010 },
-  { 0x1301018a, 0x3c000000 },
-  { 0x29810300, 0x1c00001e },
-  { 0x29810320, 0x3c000003 },
-  { 0x12810330, 0x1c000019 },
-  { 0x1201034a, 0x38000000 },
-  { 0x3b810380, 0x1c00001d },
-  { 0x3b01039f, 0x54000000 },
-  { 0x2a8103a0, 0x1c000023 },
-  { 0x2a8103c8, 0x1c000007 },
-  { 0x2a0103d0, 0x68000000 },
-  { 0x2a8103d1, 0x38000004 },
-  { 0x0d010400, 0x24000028 },
-  { 0x0d010401, 0x24000028 },
-  { 0x0d010402, 0x24000028 },
-  { 0x0d010403, 0x24000028 },
-  { 0x0d010404, 0x24000028 },
-  { 0x0d010405, 0x24000028 },
-  { 0x0d010406, 0x24000028 },
-  { 0x0d010407, 0x24000028 },
-  { 0x0d010408, 0x24000028 },
-  { 0x0d010409, 0x24000028 },
-  { 0x0d01040a, 0x24000028 },
-  { 0x0d01040b, 0x24000028 },
-  { 0x0d01040c, 0x24000028 },
-  { 0x0d01040d, 0x24000028 },
-  { 0x0d01040e, 0x24000028 },
-  { 0x0d01040f, 0x24000028 },
-  { 0x0d010410, 0x24000028 },
-  { 0x0d010411, 0x24000028 },
-  { 0x0d010412, 0x24000028 },
-  { 0x0d010413, 0x24000028 },
-  { 0x0d010414, 0x24000028 },
-  { 0x0d010415, 0x24000028 },
-  { 0x0d010416, 0x24000028 },
-  { 0x0d010417, 0x24000028 },
-  { 0x0d010418, 0x24000028 },
-  { 0x0d010419, 0x24000028 },
-  { 0x0d01041a, 0x24000028 },
-  { 0x0d01041b, 0x24000028 },
-  { 0x0d01041c, 0x24000028 },
-  { 0x0d01041d, 0x24000028 },
-  { 0x0d01041e, 0x24000028 },
-  { 0x0d01041f, 0x24000028 },
-  { 0x0d010420, 0x24000028 },
-  { 0x0d010421, 0x24000028 },
-  { 0x0d010422, 0x24000028 },
-  { 0x0d010423, 0x24000028 },
-  { 0x0d010424, 0x24000028 },
-  { 0x0d010425, 0x24000028 },
-  { 0x0d010426, 0x24000028 },
-  { 0x0d010427, 0x24000028 },
-  { 0x0d010428, 0x1400ffd8 },
-  { 0x0d010429, 0x1400ffd8 },
-  { 0x0d01042a, 0x1400ffd8 },
-  { 0x0d01042b, 0x1400ffd8 },
-  { 0x0d01042c, 0x1400ffd8 },
-  { 0x0d01042d, 0x1400ffd8 },
-  { 0x0d01042e, 0x1400ffd8 },
-  { 0x0d01042f, 0x1400ffd8 },
-  { 0x0d010430, 0x1400ffd8 },
-  { 0x0d010431, 0x1400ffd8 },
-  { 0x0d010432, 0x1400ffd8 },
-  { 0x0d010433, 0x1400ffd8 },
-  { 0x0d010434, 0x1400ffd8 },
-  { 0x0d010435, 0x1400ffd8 },
-  { 0x0d010436, 0x1400ffd8 },
-  { 0x0d010437, 0x1400ffd8 },
-  { 0x0d010438, 0x1400ffd8 },
-  { 0x0d010439, 0x1400ffd8 },
-  { 0x0d01043a, 0x1400ffd8 },
-  { 0x0d01043b, 0x1400ffd8 },
-  { 0x0d01043c, 0x1400ffd8 },
-  { 0x0d01043d, 0x1400ffd8 },
-  { 0x0d01043e, 0x1400ffd8 },
-  { 0x0d01043f, 0x1400ffd8 },
-  { 0x0d010440, 0x1400ffd8 },
-  { 0x0d010441, 0x1400ffd8 },
-  { 0x0d010442, 0x1400ffd8 },
-  { 0x0d010443, 0x1400ffd8 },
-  { 0x0d010444, 0x1400ffd8 },
-  { 0x0d010445, 0x1400ffd8 },
-  { 0x0d010446, 0x1400ffd8 },
-  { 0x0d010447, 0x1400ffd8 },
-  { 0x0d010448, 0x1400ffd8 },
-  { 0x0d010449, 0x1400ffd8 },
-  { 0x0d01044a, 0x1400ffd8 },
-  { 0x0d01044b, 0x1400ffd8 },
-  { 0x0d01044c, 0x1400ffd8 },
-  { 0x0d01044d, 0x1400ffd8 },
-  { 0x0d01044e, 0x1400ffd8 },
-  { 0x0d01044f, 0x1400ffd8 },
-  { 0x2e810450, 0x1c00004d },
-  { 0x2c8104a0, 0x34000009 },
-  { 0x0b810800, 0x1c000005 },
-  { 0x0b010808, 0x1c000000 },
-  { 0x0b81080a, 0x1c00002b },
-  { 0x0b810837, 0x1c000001 },
-  { 0x0b01083c, 0x1c000000 },
-  { 0x0b01083f, 0x1c000000 },
-  { 0x1e010a00, 0x1c000000 },
-  { 0x1e810a01, 0x30000002 },
-  { 0x1e810a05, 0x30000001 },
-  { 0x1e810a0c, 0x30000003 },
-  { 0x1e810a10, 0x1c000003 },
-  { 0x1e810a15, 0x1c000002 },
-  { 0x1e810a19, 0x1c00001a },
-  { 0x1e810a38, 0x30000002 },
-  { 0x1e010a3f, 0x30000000 },
-  { 0x1e810a40, 0x3c000007 },
-  { 0x1e810a50, 0x54000008 },
-  { 0x0981d000, 0x680000f5 },
-  { 0x0981d100, 0x68000026 },
-  { 0x0981d12a, 0x6800003a },
-  { 0x0981d165, 0x28000001 },
-  { 0x1b81d167, 0x30000002 },
-  { 0x0981d16a, 0x68000002 },
-  { 0x0981d16d, 0x28000005 },
-  { 0x0981d173, 0x04000007 },
-  { 0x1b81d17b, 0x30000007 },
-  { 0x0981d183, 0x68000001 },
-  { 0x1b81d185, 0x30000006 },
-  { 0x0981d18c, 0x6800001d },
-  { 0x1b81d1aa, 0x30000003 },
-  { 0x0981d1ae, 0x6800002f },
-  { 0x1381d200, 0x68000041 },
-  { 0x1381d242, 0x30000002 },
-  { 0x1301d245, 0x68000000 },
-  { 0x0981d300, 0x68000056 },
-  { 0x0981d400, 0x24000019 },
-  { 0x0981d41a, 0x14000019 },
-  { 0x0981d434, 0x24000019 },
-  { 0x0981d44e, 0x14000006 },
-  { 0x0981d456, 0x14000011 },
-  { 0x0981d468, 0x24000019 },
-  { 0x0981d482, 0x14000019 },
-  { 0x0901d49c, 0x24000000 },
-  { 0x0981d49e, 0x24000001 },
-  { 0x0901d4a2, 0x24000000 },
-  { 0x0981d4a5, 0x24000001 },
-  { 0x0981d4a9, 0x24000003 },
-  { 0x0981d4ae, 0x24000007 },
-  { 0x0981d4b6, 0x14000003 },
-  { 0x0901d4bb, 0x14000000 },
-  { 0x0981d4bd, 0x14000006 },
-  { 0x0981d4c5, 0x1400000a },
-  { 0x0981d4d0, 0x24000019 },
-  { 0x0981d4ea, 0x14000019 },
-  { 0x0981d504, 0x24000001 },
-  { 0x0981d507, 0x24000003 },
-  { 0x0981d50d, 0x24000007 },
-  { 0x0981d516, 0x24000006 },
-  { 0x0981d51e, 0x14000019 },
-  { 0x0981d538, 0x24000001 },
-  { 0x0981d53b, 0x24000003 },
-  { 0x0981d540, 0x24000004 },
-  { 0x0901d546, 0x24000000 },
-  { 0x0981d54a, 0x24000006 },
-  { 0x0981d552, 0x14000019 },
-  { 0x0981d56c, 0x24000019 },
-  { 0x0981d586, 0x14000019 },
-  { 0x0981d5a0, 0x24000019 },
-  { 0x0981d5ba, 0x14000019 },
-  { 0x0981d5d4, 0x24000019 },
-  { 0x0981d5ee, 0x14000019 },
-  { 0x0981d608, 0x24000019 },
-  { 0x0981d622, 0x14000019 },
-  { 0x0981d63c, 0x24000019 },
-  { 0x0981d656, 0x14000019 },
-  { 0x0981d670, 0x24000019 },
-  { 0x0981d68a, 0x1400001b },
-  { 0x0981d6a8, 0x24000018 },
-  { 0x0901d6c1, 0x64000000 },
-  { 0x0981d6c2, 0x14000018 },
-  { 0x0901d6db, 0x64000000 },
-  { 0x0981d6dc, 0x14000005 },
-  { 0x0981d6e2, 0x24000018 },
-  { 0x0901d6fb, 0x64000000 },
-  { 0x0981d6fc, 0x14000018 },
-  { 0x0901d715, 0x64000000 },
-  { 0x0981d716, 0x14000005 },
-  { 0x0981d71c, 0x24000018 },
-  { 0x0901d735, 0x64000000 },
-  { 0x0981d736, 0x14000018 },
-  { 0x0901d74f, 0x64000000 },
-  { 0x0981d750, 0x14000005 },
-  { 0x0981d756, 0x24000018 },
-  { 0x0901d76f, 0x64000000 },
-  { 0x0981d770, 0x14000018 },
-  { 0x0901d789, 0x64000000 },
-  { 0x0981d78a, 0x14000005 },
-  { 0x0981d790, 0x24000018 },
-  { 0x0901d7a9, 0x64000000 },
-  { 0x0981d7aa, 0x14000018 },
-  { 0x0901d7c3, 0x64000000 },
-  { 0x0981d7c4, 0x14000005 },
-  { 0x0981d7ce, 0x34000031 },
-  { 0x16820000, 0x1c00a6d6 },
-  { 0x1682f800, 0x1c00021d },
-  { 0x090e0001, 0x04000000 },
-  { 0x098e0020, 0x0400005f },
-  { 0x1b8e0100, 0x300000ef },
-  { 0x098f0000, 0x0c00fffd },
-  { 0x09900000, 0x0c00fffd },
-};
diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
index ab2b5d7..a862ea0 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
@@ -42,7 +42,7 @@ void MarkedArgumentBuffer::markLists(MarkStack& markStack, ListSet& markSet)
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
         MarkedArgumentBuffer* list = *it;
-        markStack.appendValues(reinterpret_cast<JSValue*>(list->m_buffer), list->m_size);
+        markStack.deprecatedAppendValues(list->m_buffer, list->m_size);
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/Arguments.cpp b/Source/JavaScriptCore/runtime/Arguments.cpp
index 39886a8..305b247 100644
--- a/Source/JavaScriptCore/runtime/Arguments.cpp
+++ b/Source/JavaScriptCore/runtime/Arguments.cpp
@@ -48,17 +48,17 @@ void Arguments::markChildren(MarkStack& markStack)
     JSObject::markChildren(markStack);
 
     if (d->registerArray)
-        markStack.appendValues(reinterpret_cast<JSValue*>(d->registerArray.get()), d->numParameters);
+        markStack.deprecatedAppendValues(d->registerArray.get(), d->numParameters);
 
     if (d->extraArguments) {
         unsigned numExtraArguments = d->numArguments - d->numParameters;
-        markStack.appendValues(reinterpret_cast<JSValue*>(d->extraArguments), numExtraArguments);
+        markStack.deprecatedAppendValues(d->extraArguments, numExtraArguments);
     }
 
-    markStack.append(d->callee);
+    markStack.append(&d->callee);
 
     if (d->activation)
-        markStack.append(d->activation);
+        markStack.append(&d->activation);
 }
 
 void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
@@ -197,7 +197,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
 
     if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
         if (!d->isStrictMode) {
-            slot.setValue(d->callee);
+            slot.setValue(d->callee.get());
             return true;
         }
         createStrictModeCalleeIfNecessary(exec);
@@ -228,7 +228,7 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     
     if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
         if (!d->isStrictMode) {
-            descriptor.setDescriptor(d->callee, DontEnum);
+            descriptor.setDescriptor(d->callee.get(), DontEnum);
             return true;
         }
         createStrictModeCalleeIfNecessary(exec);
@@ -253,7 +253,7 @@ void Arguments::getOwnPropertyNames(ExecState* exec, PropertyNameArray& property
     JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
-void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, unsigned i, JSValue value)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
@@ -263,6 +263,7 @@ void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot&
         return;
     }
 
+    PutPropertySlot slot;
     JSObject::put(exec, Identifier(exec, UString::number(i)), value, slot);
 }
 
@@ -280,14 +281,14 @@ void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
     if (propertyName == exec->propertyNames().length && !d->overrodeLength) {
         d->overrodeLength = true;
-        putDirect(propertyName, value, DontEnum);
+        putDirect(exec->globalData(), propertyName, value, DontEnum);
         return;
     }
 
     if (propertyName == exec->propertyNames().callee && !d->overrodeCallee) {
         if (!d->isStrictMode) {
             d->overrodeCallee = true;
-            putDirect(propertyName, value, DontEnum);
+            putDirect(exec->globalData(), propertyName, value, DontEnum);
             return;
         }
         createStrictModeCalleeIfNecessary(exec);
@@ -303,7 +304,7 @@ bool Arguments::deleteProperty(ExecState* exec, unsigned i)
 {
     if (i < d->numArguments) {
         if (!d->deletedArguments) {
-            d->deletedArguments.set(new bool[d->numArguments]);
+            d->deletedArguments = adoptArrayPtr(new bool[d->numArguments]);
             memset(d->deletedArguments.get(), 0, sizeof(bool) * d->numArguments);
         }
         if (!d->deletedArguments[i]) {
@@ -321,7 +322,7 @@ bool Arguments::deleteProperty(ExecState* exec, const Identifier& propertyName)
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex && i < d->numArguments) {
         if (!d->deletedArguments) {
-            d->deletedArguments.set(new bool[d->numArguments]);
+            d->deletedArguments = adoptArrayPtr(new bool[d->numArguments]);
             memset(d->deletedArguments.get(), 0, sizeof(bool) * d->numArguments);
         }
         if (!d->deletedArguments[i]) {
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index fe900a2..658538b 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -37,7 +37,7 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(ArgumentsData); WTF_MAKE_FAST_ALLOCATED;
     public:
         ArgumentsData() { }
-        JSActivation* activation;
+        WriteBarrier<JSActivation> activation;
 
         unsigned numParameters;
         ptrdiff_t firstParameterIndex;
@@ -50,7 +50,7 @@ namespace JSC {
         OwnArrayPtr<bool> deletedArguments;
         Register extraArgumentsFixedBuffer[4];
 
-        JSFunction* callee;
+        WriteBarrier<JSFunction> callee;
         bool overrodeLength : 1;
         bool overrodeCallee : 1;
         bool overrodeCaller : 1;
@@ -86,9 +86,9 @@ namespace JSC {
         void copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize);
         void copyRegisters();
         bool isTornOff() const { return d->registerArray; }
-        void setActivation(JSActivation* activation)
+        void setActivation(JSGlobalData& globalData, JSActivation* activation)
         {
-            d->activation = activation;
+            d->activation.set(globalData, this, activation);
             d->registers = &activation->registerAt(0);
         }
 
@@ -107,7 +107,7 @@ namespace JSC {
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
         void createStrictModeCallerIfNecessary(ExecState*);
@@ -158,7 +158,6 @@ namespace JSC {
         d->firstParameterIndex = firstParameterIndex;
         d->numArguments = numArguments;
 
-        d->activation = 0;
         d->registers = callFrame->registers();
 
         Register* extraArguments;
@@ -176,7 +175,7 @@ namespace JSC {
 
         d->extraArguments = extraArguments;
 
-        d->callee = callee;
+        d->callee.set(callFrame->globalData(), this, callee);
         d->overrodeLength = false;
         d->overrodeCallee = false;
         d->overrodeCaller = false;
@@ -195,7 +194,6 @@ namespace JSC {
 
         d->numParameters = 0;
         d->numArguments = numArguments;
-        d->activation = 0;
 
         Register* extraArguments;
         if (numArguments > sizeof(d->extraArgumentsFixedBuffer) / sizeof(Register))
@@ -209,7 +207,7 @@ namespace JSC {
 
         d->extraArguments = extraArguments;
 
-        d->callee = asFunction(callFrame->callee());
+        d->callee.set(callFrame->globalData(), this, asFunction(callFrame->callee()));
         d->overrodeLength = false;
         d->overrodeCallee = false;
         d->overrodeCaller = false;
@@ -228,10 +226,10 @@ namespace JSC {
         int registerOffset = d->numParameters + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = d->numParameters;
 
-        Register* registerArray = new Register[registerArraySize];
-        memcpy(registerArray, d->registers - registerOffset, registerArraySize * sizeof(Register));
-        d->registerArray.set(registerArray);
-        d->registers = registerArray + registerOffset;
+        OwnArrayPtr<Register> registerArray = adoptArrayPtr(new Register[registerArraySize]);
+        memcpy(registerArray.get(), d->registers - registerOffset, registerArraySize * sizeof(Register));
+        d->registers = registerArray.get() + registerOffset;
+        d->registerArray = registerArray.release();
     }
 
     // This JSActivation function is defined here so it can get at Arguments::setRegisters.
@@ -249,8 +247,9 @@ namespace JSC {
         int registerOffset = numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = numLocals + RegisterFile::CallFrameHeaderSize;
 
-        Register* registerArray = copyRegisterArray(d()->registers - registerOffset, registerArraySize);
-        setRegisters(registerArray + registerOffset, registerArray);
+        OwnArrayPtr<Register> registerArray = copyRegisterArray(d()->registers - registerOffset, registerArraySize);
+        Register* registers = registerArray.get() + registerOffset;
+        setRegisters(registers, registerArray.release());
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index 632d466..5d0adbd 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -42,10 +42,10 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, arrayPrototype->classInfo()->className))
 {
     // ECMA 15.4.3.1 Array.prototype
-    putDirectWithoutTransition(exec->propertyNames().prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 
     // ES5
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
@@ -62,7 +62,7 @@ static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgLi
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), args);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithArrayConstructor(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7615ffc..70c0d06 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -117,7 +117,7 @@ const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::a
 ArrayPrototype::ArrayPrototype(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : JSArray(structure)
 {
-    putAnonymousValue(0, globalObject);
+    putAnonymousValue(globalObject->globalData(), 0, globalObject);
 }
 
 bool ArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -545,9 +545,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 
     JSArray* resObj = new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
     JSValue result = resObj;
-
+    JSGlobalData& globalData = exec->globalData();
     for (unsigned k = 0; k < deleteCount; k++)
-        resObj->uncheckedSetIndex(k, getProperty(exec, thisObj, k + begin));
+        resObj->uncheckedSetIndex(globalData, k, getProperty(exec, thisObj, k + begin));
 
     resObj->setLength(deleteCount);
 
diff --git a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index db2d1d7..0f6a646 100644
--- a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -34,8 +34,9 @@ namespace JSC {
     class BatchedTransitionOptimizer {
         WTF_MAKE_NONCOPYABLE(BatchedTransitionOptimizer);
     public:
-        BatchedTransitionOptimizer(JSObject* object)
-            : m_object(object)
+        BatchedTransitionOptimizer(JSGlobalData& globalData, JSObject* object)
+            : m_globalData(&globalData)
+            , m_object(object)
         {
             if (!m_object->structure()->isDictionary())
                 m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
@@ -43,10 +44,11 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->flattenDictionaryObject();
+            m_object->flattenDictionaryObject(*m_globalData);
         }
 
     private:
+        JSGlobalData* m_globalData;
         JSObject* m_object;
     };
 
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
index 0167e03..21ef5bb 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -31,17 +31,17 @@ ASSERT_CLASS_FITS_IN_CELL(BooleanConstructor);
 BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, BooleanPrototype* booleanPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, booleanPrototype->classInfo()->className))
 {
-    putDirectWithoutTransition(exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
 // ECMA 15.6.2
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
-    obj->setInternalValue(jsBoolean(args.at(0).toBoolean(exec)));
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    obj->setInternalValue(exec->globalData(), jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
 
@@ -71,8 +71,8 @@ CallType BooleanConstructor::getCallData(CallData& callData)
 
 JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
-    obj->setInternalValue(immediateBooleanValue);
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    obj->setInternalValue(exec->globalData(), immediateBooleanValue);
     return obj;
 }
 
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.cpp b/Source/JavaScriptCore/runtime/BooleanObject.cpp
index c9b3846..71ff2d2 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanObject.cpp
@@ -27,8 +27,8 @@ ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
 
 const ClassInfo BooleanObject::info = { "Boolean", 0, 0, 0 };
 
-BooleanObject::BooleanObject(NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+BooleanObject::BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
+    : JSWrapperObject(globalData, structure)
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.h b/Source/JavaScriptCore/runtime/BooleanObject.h
index 4b02acb..ff10ef6 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.h
+++ b/Source/JavaScriptCore/runtime/BooleanObject.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class BooleanObject : public JSWrapperObject {
     public:
-        explicit BooleanObject(NonNullPassRefPtr<Structure>);
+        explicit BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure>);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
index 7ffd095..54d621c 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -39,9 +39,9 @@ static EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*);
 // ECMA 15.6.4
 
 BooleanPrototype::BooleanPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
-    : BooleanObject(structure)
+    : BooleanObject(exec->globalData(), structure)
 {
-    setInternalValue(jsBoolean(false));
+    setInternalValue(exec->globalData(), jsBoolean(false));
 
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
diff --git a/Source/JavaScriptCore/runtime/CollectorHeapIterator.h b/Source/JavaScriptCore/runtime/CollectorHeapIterator.h
deleted file mode 100644
index 7229d77..0000000
--- a/Source/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "Heap.h"
-
-#ifndef CollectorHeapIterator_h
-#define CollectorHeapIterator_h
-
-namespace JSC {
-
-    class CollectorHeapIterator {
-    public:
-        bool operator!=(const CollectorHeapIterator& other);
-        JSCell* operator*() const;
-    
-    protected:
-        CollectorHeapIterator(CollectorHeap&, size_t startBlock, size_t startCell);
-        void advance(size_t max);
-
-        CollectorHeap& m_heap;
-        size_t m_block;
-        size_t m_cell;
-    };
-
-    class LiveObjectIterator : public CollectorHeapIterator {
-    public:
-        LiveObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
-        LiveObjectIterator& operator++();
-    };
-
-    class DeadObjectIterator : public CollectorHeapIterator {
-    public:
-        DeadObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
-        DeadObjectIterator& operator++();
-    };
-
-    class ObjectIterator : public CollectorHeapIterator {
-    public:
-        ObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
-        ObjectIterator& operator++();
-    };
-
-    inline CollectorHeapIterator::CollectorHeapIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
-        : m_heap(heap)
-        , m_block(startBlock)
-        , m_cell(startCell)
-    {
-    }
-
-    inline bool CollectorHeapIterator::operator!=(const CollectorHeapIterator& other)
-    {
-        return m_block != other.m_block || m_cell != other.m_cell;
-    }
-
-    inline JSCell* CollectorHeapIterator::operator*() const
-    {
-        return reinterpret_cast<JSCell*>(&m_heap.collectorBlock(m_block)->cells[m_cell]);
-    }
-    
-    // Iterators advance up to the next-to-last -- and not the last -- cell in a
-    // block, since the last cell is a dummy sentinel.
-    inline void CollectorHeapIterator::advance(size_t max)
-    {
-        ++m_cell;
-        if (m_cell == max) {
-            m_cell = 0;
-            ++m_block;
-        }
-    }
-
-    inline LiveObjectIterator::LiveObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
-        : CollectorHeapIterator(heap, startBlock, startCell - 1)
-    {
-        ++(*this);
-    }
-
-    inline LiveObjectIterator& LiveObjectIterator::operator++()
-    {
-        advance(HeapConstants::cellsPerBlock - 1);
-        if (m_block < m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell < m_heap.nextCell))
-            return *this;
-
-        while (m_block < m_heap.usedBlocks && !m_heap.collectorBlock(m_block)->marked.get(m_cell))
-            advance(HeapConstants::cellsPerBlock - 1);
-        return *this;
-    }
-
-    inline DeadObjectIterator::DeadObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
-        : CollectorHeapIterator(heap, startBlock, startCell - 1)
-    {
-        ++(*this);
-    }
-
-    inline DeadObjectIterator& DeadObjectIterator::operator++()
-    {
-        do {
-            advance(HeapConstants::cellsPerBlock - 1);
-            ASSERT(m_block > m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell >= m_heap.nextCell));
-        } while (m_block < m_heap.usedBlocks && m_heap.collectorBlock(m_block)->marked.get(m_cell));
-        return *this;
-    }
-
-    inline ObjectIterator::ObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
-        : CollectorHeapIterator(heap, startBlock, startCell - 1)
-    {
-        ++(*this);
-    }
-
-    inline ObjectIterator& ObjectIterator::operator++()
-    {
-        advance(HeapConstants::cellsPerBlock - 1);
-        return *this;
-    }
-
-} // namespace JSC
-
-#endif // CollectorHeapIterator_h
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.cpp b/Source/JavaScriptCore/runtime/ConservativeSet.cpp
new file mode 100644
index 0000000..bc8bd6d
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ConservativeSet.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConservativeSet.h"
+
+namespace JSC {
+
+inline bool isPointerAligned(void* p)
+{
+    return !((intptr_t)(p) & (sizeof(char*) - 1));
+}
+
+void ConservativeSet::grow()
+{
+    size_t newCapacity = m_capacity == inlineCapacity ? nonInlineCapacity : m_capacity * 2;
+    DeprecatedPtr<JSCell>* newSet = static_cast<DeprecatedPtr<JSCell>*>(OSAllocator::reserveAndCommit(newCapacity * sizeof(JSCell*)));
+    memcpy(newSet, m_set, m_size * sizeof(JSCell*));
+    if (m_set != m_inlineSet)
+        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(JSCell*));
+    m_capacity = newCapacity;
+    m_set = newSet;
+}
+
+void ConservativeSet::add(void* begin, void* end)
+{
+    ASSERT(begin <= end);
+    ASSERT((static_cast<char*>(end) - static_cast<char*>(begin)) < 0x1000000);
+    ASSERT(isPointerAligned(begin));
+    ASSERT(isPointerAligned(end));
+
+    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it) {
+        if (!m_heap->contains(*it))
+            continue;
+
+        if (m_size == m_capacity)
+            grow();
+
+        m_set[m_size++] = reinterpret_cast<JSCell*>(*it);
+    }
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.h b/Source/JavaScriptCore/runtime/ConservativeSet.h
new file mode 100644
index 0000000..e7c2c4a
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ConservativeSet.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ConservativeSet_h
+#define ConservativeSet_h
+
+#include "Heap.h"
+#include "MarkStack.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSCell;
+
+class ConservativeSet {
+public:
+    ConservativeSet(Heap*);
+    ~ConservativeSet();
+
+    void add(void* begin, void* end);
+    void mark(MarkStack&);
+
+private:
+    static const size_t inlineCapacity = 128;
+    static const size_t nonInlineCapacity = 8192 / sizeof(JSCell*);
+    
+    void grow();
+
+    Heap* m_heap;
+    DeprecatedPtr<JSCell>* m_set;
+    size_t m_size;
+    size_t m_capacity;
+    DeprecatedPtr<JSCell> m_inlineSet[inlineCapacity];
+};
+
+inline ConservativeSet::ConservativeSet(Heap* heap)
+    : m_heap(heap)
+    , m_set(m_inlineSet)
+    , m_size(0)
+    , m_capacity(inlineCapacity)
+{
+}
+
+inline ConservativeSet::~ConservativeSet()
+{
+    if (m_set != m_inlineSet)
+        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(DeprecatedPtr<JSCell>*));
+}
+
+inline void ConservativeSet::mark(MarkStack& markStack)
+{
+    for (size_t i = 0; i < m_size; ++i)
+        markStack.append(&m_set[i]);
+}
+
+} // namespace JSC
+
+#endif // ConservativeSet_h
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index dcbe12d..f1f3956 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -61,13 +61,13 @@ static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState*);
 DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, datePrototype->classInfo()->className))
 {
-      putDirectWithoutTransition(exec->propertyNames().prototype, datePrototype, DontEnum|DontDelete|ReadOnly);
+      putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
 
       putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
       putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
       putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
-      putDirectWithoutTransition(exec->propertyNames().length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
+      putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
 }
 
 // ECMA 15.9.3
diff --git a/Source/JavaScriptCore/runtime/DateInstance.cpp b/Source/JavaScriptCore/runtime/DateInstance.cpp
index 8562e2d..44e8b7d 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.cpp
+++ b/Source/JavaScriptCore/runtime/DateInstance.cpp
@@ -34,22 +34,22 @@ namespace JSC {
 
 const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
 
-DateInstance::DateInstance(ExecState*, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+    : JSWrapperObject(exec->globalData(), structure)
 {
-    setInternalValue(jsNaN());
+    setInternalValue(exec->globalData(), jsNaN());
 }
 
-DateInstance::DateInstance(ExecState*, NonNullPassRefPtr<Structure> structure, double time)
-    : JSWrapperObject(structure)
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+    : JSWrapperObject(exec->globalData(), structure)
 {
-    setInternalValue(jsNumber(timeClip(time)));
+    setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
 }
 
 DateInstance::DateInstance(ExecState* exec, double time)
-    : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
+    : JSWrapperObject(exec->globalData(), exec->lexicalGlobalObject()->dateStructure())
 {
-    setInternalValue(jsNumber(timeClip(time)));
+    setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
 }
 
 const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 085cb33..5838b60 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -433,7 +433,7 @@ DatePrototype::DatePrototype(ExecState* exec, JSGlobalObject* globalObject, NonN
     : DateInstance(exec, structure)
 {
     // The constructor will be added later, after DateConstructor has been built.
-    putAnonymousValue(0, globalObject);
+    putAnonymousValue(exec->globalData(), 0, globalObject);
 }
 
 bool DatePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -845,7 +845,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
 
     double milli = timeClip(exec->argument(0).toNumber(exec));
     JSValue result = jsNumber(milli);
-    thisDateObj->setInternalValue(result);
+    thisDateObj->setInternalValue(exec->globalData(), result);
     return JSValue::encode(result);
 }
 
@@ -860,7 +860,7 @@ static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse,
     
     if (!exec->argumentCount() || isnan(milli)) {
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }
      
@@ -877,12 +877,12 @@ static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse,
     gregorianDateTime.copyFrom(*other);
     if (!fillStructuresUsingTimeArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     } 
     
     JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
-    thisDateObj->setInternalValue(result);
+    thisDateObj->setInternalValue(exec->globalData(), result);
     return JSValue::encode(result);
 }
 
@@ -895,7 +895,7 @@ static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse,
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (!exec->argumentCount()) {
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }      
     
@@ -917,12 +917,12 @@ static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse,
     
     if (!fillStructuresUsingDateArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     } 
            
     JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
-    thisDateObj->setInternalValue(result);
+    thisDateObj->setInternalValue(exec->globalData(), result);
     return JSValue::encode(result);
 }
 
@@ -1019,7 +1019,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (!exec->argumentCount()) { 
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }
     
@@ -1041,13 +1041,13 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
     double year = exec->argument(0).toIntegerPreserveNaN(exec);
     if (!isfinite(year)) {
         JSValue result = jsNaN();
-        thisDateObj->setInternalValue(result);
+        thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }
             
     gregorianDateTime.year = toInt32((year > 99 || year < 0) ? year - 1900 : year);
     JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
-    thisDateObj->setInternalValue(result);
+    thisDateObj->setInternalValue(exec->globalData(), result);
     return JSValue::encode(result);
 }
 
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index 227e9ec..b84f5ea 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -201,7 +201,7 @@ private:
     UString m_message;
 };
 
-COMPILE_ASSERT(sizeof(StrictModeTypeErrorFunction) <= sizeof(CollectorCell), sizeof_StrictModeTypeErrorFunction_must_be_less_than_CollectorCell);
+ASSERT_CLASS_FITS_IN_CELL(StrictModeTypeErrorFunction);
 
 JSValue createTypeErrorFunction(ExecState* exec, const UString& message)
 {
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
index 4326a4d..2e53b95 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -33,8 +33,8 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, errorPrototype->classInfo()->className))
 {
     // ECMA 15.11.3.1 Error.prototype
-    putDirectWithoutTransition(exec->propertyNames().prototype, errorPrototype, DontEnum | DontDelete | ReadOnly);
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, errorPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum);
 }
 
 // ECMA 15.9.3
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
index 0f3153c..a6208d5 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -29,14 +29,14 @@ ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structu
     : JSObject(structure)
     , m_appendSourceToMessage(false)
 {
-    putDirect(globalData->propertyNames->message, jsString(globalData, ""));
+    putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, ""));
 }
 
 ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
     : JSObject(structure)
     , m_appendSourceToMessage(false)
 {
-    putDirect(globalData->propertyNames->message, jsString(globalData, message));
+    putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
 ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index d8fc829..b4e0a7c 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -41,7 +41,7 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, No
 {
     // The constructor will be added later in ErrorConstructor's constructor
 
-    putDirectWithoutTransition(exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
 }
 
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index 45b4802..933b11f 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -40,10 +40,10 @@ ASSERT_CLASS_FITS_IN_CELL(FunctionConstructor);
 FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, FunctionPrototype* functionPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, functionPrototype->classInfo()->className))
 {
-    putDirectWithoutTransition(exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
 
     // Number of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithFunctionConstructor(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
index cd7739d..e651538 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -41,7 +41,7 @@ static EncodedJSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*);
 FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), globalObject, structure, exec->propertyNames().nullIdentifier)
 {
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
 }
 
 void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.h b/Source/JavaScriptCore/runtime/GCActivityCallback.h
index 862b4df..9b6ef04 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.h
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.h
@@ -32,6 +32,10 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
+#if PLATFORM(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
 namespace JSC {
 
 class Heap;
@@ -58,6 +62,12 @@ public:
     void operator()();
     void synchronize();
 
+#if PLATFORM(CF)
+protected:
+    DefaultGCActivityCallback(Heap*, CFRunLoopRef);
+    void commonConstructor(Heap*, CFRunLoopRef);
+#endif
+
 private:
     OwnPtr<DefaultGCActivityCallbackPlatformData*> d;
 };
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
index 414a0ad..211c423 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
@@ -35,7 +35,6 @@
 #include "JSLock.h"
 #include <wtf/RetainPtr.h>
 #include <wtf/WTFThreadData.h>
-#include <CoreFoundation/CoreFoundation.h>
 
 #if !PLATFORM(CF)
 #error "This file should only be used on CF platforms."
@@ -54,22 +53,22 @@ struct DefaultGCActivityCallbackPlatformData {
 const CFTimeInterval decade = 60 * 60 * 24 * 365 * 10;
 const CFTimeInterval triggerInterval = 2; // seconds
 
-void DefaultGCActivityCallbackPlatformData::trigger(CFRunLoopTimerRef, void *info)
+void DefaultGCActivityCallbackPlatformData::trigger(CFRunLoopTimerRef timer, void *info)
 {
     Heap* heap = static_cast<Heap*>(info);
     APIEntryShim shim(heap->globalData());
     heap->collectAllGarbage();
+    CFRunLoopTimerSetNextFireDate(timer, CFAbsoluteTimeGetCurrent() + decade);
 }
 
 DefaultGCActivityCallback::DefaultGCActivityCallback(Heap* heap)
 {
-    d = adoptPtr(new DefaultGCActivityCallbackPlatformData);
+    commonConstructor(heap, CFRunLoopGetCurrent());
+}
 
-    memset(&d->context, '\0', sizeof(CFRunLoopTimerContext));
-    d->context.info = heap;
-    d->runLoop = CFRunLoopGetCurrent();
-    d->timer.adoptCF(CFRunLoopTimerCreate(0, decade, decade, 0, 0, DefaultGCActivityCallbackPlatformData::trigger, &d->context));
-    CFRunLoopAddTimer(d->runLoop.get(), d->timer.get(), kCFRunLoopCommonModes);
+DefaultGCActivityCallback::DefaultGCActivityCallback(Heap* heap, CFRunLoopRef runLoop)
+{
+    commonConstructor(heap, runLoop);
 }
 
 DefaultGCActivityCallback::~DefaultGCActivityCallback()
@@ -81,6 +80,17 @@ DefaultGCActivityCallback::~DefaultGCActivityCallback()
     d->timer = 0;
 }
 
+void DefaultGCActivityCallback::commonConstructor(Heap* heap, CFRunLoopRef runLoop)
+{
+    d = adoptPtr(new DefaultGCActivityCallbackPlatformData);
+
+    memset(&d->context, 0, sizeof(CFRunLoopTimerContext));
+    d->context.info = heap;
+    d->runLoop = runLoop;
+    d->timer.adoptCF(CFRunLoopTimerCreate(0, decade, decade, 0, 0, DefaultGCActivityCallbackPlatformData::trigger, &d->context));
+    CFRunLoopAddTimer(d->runLoop.get(), d->timer.get(), kCFRunLoopCommonModes);
+}
+
 void DefaultGCActivityCallback::operator()()
 {
     CFRunLoopTimerSetNextFireDate(d->timer.get(), CFAbsoluteTimeGetCurrent() + triggerInterval);
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.cpp b/Source/JavaScriptCore/runtime/GetterSetter.cpp
index 7e54053..2b9f444 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/Source/JavaScriptCore/runtime/GetterSetter.cpp
@@ -33,9 +33,9 @@ void GetterSetter::markChildren(MarkStack& markStack)
     JSCell::markChildren(markStack);
 
     if (m_getter)
-        markStack.append(m_getter);
+        markStack.append(&m_getter);
     if (m_setter)
-        markStack.append(m_setter);
+        markStack.append(&m_setter);
 }
 
 bool GetterSetter::isGetterSetter() const
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.h b/Source/JavaScriptCore/runtime/GetterSetter.h
index e7b1938..ffab94d 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.h
+++ b/Source/JavaScriptCore/runtime/GetterSetter.h
@@ -38,17 +38,15 @@ namespace JSC {
     public:
         GetterSetter(ExecState* exec)
             : JSCell(exec->globalData().getterSetterStructure.get())
-            , m_getter(0)
-            , m_setter(0)
         {
         }
 
         virtual void markChildren(MarkStack&);
 
-        JSObject* getter() const { return m_getter; }
-        void setGetter(JSObject* getter) { m_getter = getter; }
-        JSObject* setter() const { return m_setter; }
-        void setSetter(JSObject* setter) { m_setter = setter; }
+        JSObject* getter() const { return m_getter.get(); }
+        void setGetter(JSGlobalData& globalData, JSObject* getter) { m_getter.set(globalData, this, getter); }
+        JSObject* setter() const { return m_setter.get(); }
+        void setSetter(JSGlobalData& globalData, JSObject* setter) { m_setter.set(globalData, this, setter); }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount);
@@ -56,8 +54,8 @@ namespace JSC {
     private:
         virtual bool isGetterSetter() const;
 
-        JSObject* m_getter;
-        JSObject* m_setter;  
+        WriteBarrier<JSObject> m_getter;
+        WriteBarrier<JSObject> m_setter;  
     };
 
     GetterSetter* asGetterSetter(JSValue);
diff --git a/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp b/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp
index 3ad4644..27207e2 100644
--- a/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(GlobalEvalFunction);
 
 GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int len, const Identifier& name, NativeFunction function, JSGlobalObject* cachedGlobalObject)
     : PrototypeFunction(exec, globalObject, structure, len, name, function)
-    , m_cachedGlobalObject(cachedGlobalObject)
+    , m_cachedGlobalObject(exec->globalData(), this, cachedGlobalObject)
 {
     ASSERT_ARG(cachedGlobalObject, cachedGlobalObject);
 }
@@ -42,7 +42,7 @@ GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, JSGlobalObject* globalOb
 void GlobalEvalFunction::markChildren(MarkStack& markStack)
 {
     PrototypeFunction::markChildren(markStack);
-    markStack.append(m_cachedGlobalObject);
+    markStack.append(&m_cachedGlobalObject);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/GlobalEvalFunction.h b/Source/JavaScriptCore/runtime/GlobalEvalFunction.h
index b889ca9..13f0946 100644
--- a/Source/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/Source/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -33,7 +33,7 @@ namespace JSC {
     class GlobalEvalFunction : public PrototypeFunction {
     public:
         GlobalEvalFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int len, const Identifier&, NativeFunction, JSGlobalObject* expectedThisObject);
-        JSGlobalObject* cachedGlobalObject() const { return m_cachedGlobalObject; }
+        JSGlobalObject* cachedGlobalObject() const { return m_cachedGlobalObject.get(); }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
@@ -46,7 +46,7 @@ namespace JSC {
     private:
         virtual void markChildren(MarkStack&);
 
-        JSGlobalObject* m_cachedGlobalObject;
+        WriteBarrier<JSGlobalObject> m_cachedGlobalObject;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Heap.cpp b/Source/JavaScriptCore/runtime/Heap.cpp
index 3966324..c05233c 100644
--- a/Source/JavaScriptCore/runtime/Heap.cpp
+++ b/Source/JavaScriptCore/runtime/Heap.cpp
@@ -21,7 +21,8 @@
 #include "config.h"
 #include "Heap.h"
 
-#include "CollectorHeapIterator.h"
+#include "CodeBlock.h"
+#include "ConservativeSet.h"
 #include "GCActivityCallback.h"
 #include "GCHandle.h"
 #include "Interpreter.h"
@@ -30,14 +31,19 @@
 #include "JSLock.h"
 #include "JSONObject.h"
 #include "Tracing.h"
+#include <algorithm>
 
 #define COLLECT_ON_EVERY_ALLOCATION 0
 
+using namespace std;
+
 namespace JSC {
 
+const size_t minBytesPerCycle = 512 * 1024;
+
 Heap::Heap(JSGlobalData* globalData)
-    : m_markedSpace(globalData)
-    , m_operationInProgress(NoOperation)
+    : m_operationInProgress(NoOperation)
+    , m_markedSpace(globalData)
     , m_markListSet(0)
     , m_activityCallback(DefaultGCActivityCallback::create(this))
     , m_globalData(globalData)
@@ -71,14 +77,12 @@ void Heap::destroy()
     delete m_markListSet;
     m_markListSet = 0;
 
-    ProtectCountSet protectedValuesCopy = m_protectedValues;
-    m_markedSpace.destroy(protectedValuesCopy);
-    ASSERT(!protectedObjectCount());
+    m_markedSpace.destroy();
 
     m_globalData = 0;
 }
 
-void Heap::recordExtraCost(size_t cost)
+void Heap::reportExtraMemoryCostSlowCase(size_t cost)
 {
     // Our frequency of garbage collection tries to balance memory use against speed
     // by collecting based on the number of newly created values. However, for values
@@ -91,20 +95,8 @@ void Heap::recordExtraCost(size_t cost)
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
 
-    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.size() / 2) {
-        JAVASCRIPTCORE_GC_BEGIN();
-
-        markRoots();
-
-        JAVASCRIPTCORE_GC_MARKED();
-
-        m_markedSpace.reset();
-        m_extraCost = 0;
-
-        JAVASCRIPTCORE_GC_END();
-
-        (*m_activityCallback)();
-    }
+    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.capacity() / 2)
+        collectAllGarbage();
     m_extraCost += cost;
 }
 
@@ -113,7 +105,7 @@ void* Heap::allocate(size_t s)
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     ASSERT(JSLock::lockCount() > 0);
     ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= HeapConstants::cellSize);
+    ASSERT_UNUSED(s, s <= MarkedBlock::CELL_SIZE);
     ASSERT(m_operationInProgress == NoOperation);
 
 #if COLLECT_ON_EVERY_ALLOCATION
@@ -124,34 +116,18 @@ void* Heap::allocate(size_t s)
     m_operationInProgress = Allocation;
     void* result = m_markedSpace.allocate(s);
     m_operationInProgress = NoOperation;
-
     if (!result) {
-        JAVASCRIPTCORE_GC_BEGIN();
-
-        markRoots();
-
-        JAVASCRIPTCORE_GC_MARKED();
-
-        m_markedSpace.reset();
-        m_extraCost = 0;
-
-        JAVASCRIPTCORE_GC_END();
-
-        (*m_activityCallback)();
+        reset(DoNotSweep);
 
         m_operationInProgress = Allocation;
         result = m_markedSpace.allocate(s);
         m_operationInProgress = NoOperation;
     }
+
     ASSERT(result);
     return result;
 }
 
-void Heap::markConservatively(ConservativeSet& conservativeSet, void* start, void* end)
-{
-    m_markedSpace.markConservatively(conservativeSet, start, end);
-}
-
 void Heap::updateWeakGCHandles()
 {
     for (unsigned i = 0; i < m_weakGCHandlePools.size(); ++i)
@@ -163,7 +139,7 @@ void WeakGCHandlePool::update()
     for (unsigned i = 1; i < WeakGCHandlePool::numPoolEntries; ++i) {
         if (m_entries[i].isValidPtr()) {
             JSCell* cell = m_entries[i].get();
-            if (!cell || !Heap::isCellMarked(cell))
+            if (!cell || !Heap::isMarked(cell))
                 m_entries[i].invalidate();
         }
     }
@@ -208,7 +184,7 @@ void Heap::markProtectedObjects(MarkStack& markStack)
 {
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
-        markStack.append(it->first);
+        markStack.deprecatedAppend(&it->first);
 }
 
 void Heap::pushTempSortVector(Vector<ValueStringPair>* tempVector)
@@ -233,11 +209,16 @@ void Heap::markTempSortVectors(MarkStack& markStack)
         Vector<ValueStringPair>::iterator vectorEnd = tempSortingVector->end();
         for (Vector<ValueStringPair>::iterator vectorIt = tempSortingVector->begin(); vectorIt != vectorEnd; ++vectorIt) {
             if (vectorIt->first)
-                markStack.append(vectorIt->first);
+                markStack.deprecatedAppend(&vectorIt->first);
         }
     }
 }
-    
+
+inline RegisterFile& Heap::registerFile()
+{
+    return m_globalData->interpreter->registerFile();
+}
+
 void Heap::markRoots()
 {
 #ifndef NDEBUG
@@ -256,12 +237,11 @@ void Heap::markRoots()
     // We gather the conservative set before clearing mark bits, because
     // conservative gathering uses the mark bits from our last mark pass to
     // determine whether a reference is valid.
-    ConservativeSet conservativeSet;
+    ConservativeSet conservativeSet(this);
     m_machineStackMarker.markMachineStackConservatively(conservativeSet);
-    m_globalData->interpreter->registerFile().markCallFrames(conservativeSet, this);
+    conservativeSet.add(registerFile().start(), registerFile().end());
 
-    // Reset mark bits.
-    m_markedSpace.clearMarkBits();
+    m_markedSpace.clearMarks();
 
     MarkStack& markStack = m_markStack;
     conservativeSet.mark(markStack);
@@ -274,12 +254,17 @@ void Heap::markRoots()
     // Mark temporary vector for Array sorting
     markTempSortVectors(markStack);
     markStack.drain();
+    
+    HashSet<GlobalCodeBlock*>::const_iterator end = m_codeBlocks.end();
+    for (HashSet<GlobalCodeBlock*>::const_iterator it = m_codeBlocks.begin(); it != end; ++it)
+        (*it)->markAggregate(markStack);
+    markStack.drain();
 
     // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
         MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
     if (m_globalData->exception)
-        markStack.append(m_globalData->exception);
+        markStack.append(&m_globalData->exception);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
     markStack.drain();
@@ -301,39 +286,30 @@ size_t Heap::objectCount() const
     return m_markedSpace.objectCount();
 }
 
-MarkedSpace::Statistics Heap::statistics() const
+size_t Heap::size() const
 {
-    return m_markedSpace.statistics();
+    return m_markedSpace.size();
 }
 
-size_t Heap::size() const
+size_t Heap::capacity() const
 {
-    return m_markedSpace.size();
+    return m_markedSpace.capacity();
 }
 
 size_t Heap::globalObjectCount()
 {
-    size_t count = 0;
-    if (JSGlobalObject* head = m_globalData->head) {
-        JSGlobalObject* o = head;
-        do {
-            ++count;
-            o = o->next();
-        } while (o != head);
-    }
-    return count;
+    return m_globalData->globalObjects.uncheckedSize();
 }
 
 size_t Heap::protectedGlobalObjectCount()
 {
     size_t count = 0;
-    if (JSGlobalObject* head = m_globalData->head) {
-        JSGlobalObject* o = head;
-        do {
-            if (m_protectedValues.contains(o))
-                ++count;
-            o = o->next();
-        } while (o != head);
+
+    GlobalObjectMap& map = m_globalData->globalObjects;
+    GlobalObjectMap::iterator end = map.uncheckedEnd();
+    for (GlobalObjectMap::iterator it = map.uncheckedBegin(); it != end; ++it) {
+        if (map.isValid(it) && m_protectedValues.contains(it->second.get()))
+            ++count;
     }
 
     return count;
@@ -344,7 +320,23 @@ size_t Heap::protectedObjectCount()
     return m_protectedValues.size();
 }
 
-static const char* typeName(JSCell* cell)
+class TypeCounter {
+public:
+    TypeCounter();
+    void operator()(JSCell*);
+    PassOwnPtr<TypeCountSet> take();
+    
+private:
+    const char* typeName(JSCell*);
+    OwnPtr<TypeCountSet> m_typeCountSet;
+};
+
+inline TypeCounter::TypeCounter()
+    : m_typeCountSet(new TypeCountSet)
+{
+}
+
+inline const char* TypeCounter::typeName(JSCell* cell)
 {
     if (cell->isString())
         return "string";
@@ -360,27 +352,32 @@ static const char* typeName(JSCell* cell)
     return info ? info->className : "Object";
 }
 
-HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
+inline void TypeCounter::operator()(JSCell* cell)
+{
+    m_typeCountSet->add(typeName(cell));
+}
+
+inline PassOwnPtr<TypeCountSet> TypeCounter::take()
+{
+    return m_typeCountSet.release();
+}
+
+PassOwnPtr<TypeCountSet> Heap::protectedObjectTypeCounts()
 {
-    HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
+    TypeCounter typeCounter;
 
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
-        counts->add(typeName(it->first));
+        typeCounter(it->first);
 
-    return counts;
+    return typeCounter.take();
 }
 
-HashCountedSet<const char*>* Heap::objectTypeCounts()
+PassOwnPtr<TypeCountSet> Heap::objectTypeCounts()
 {
-    HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
-
-    LiveObjectIterator it = primaryHeapBegin();
-    LiveObjectIterator heapEnd = primaryHeapEnd();
-    for ( ; it != heapEnd; ++it)
-        counts->add(typeName(*it));
-
-    return counts;
+    TypeCounter typeCounter;
+    forEach(typeCounter);
+    return typeCounter.take();
 }
 
 bool Heap::isBusy()
@@ -390,6 +387,11 @@ bool Heap::isBusy()
 
 void Heap::collectAllGarbage()
 {
+    reset(DoSweep);
+}
+
+void Heap::reset(SweepToggle sweepToggle)
+{
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     JAVASCRIPTCORE_GC_BEGIN();
 
@@ -398,22 +400,19 @@ void Heap::collectAllGarbage()
     JAVASCRIPTCORE_GC_MARKED();
 
     m_markedSpace.reset();
-    m_markedSpace.sweep();
     m_extraCost = 0;
 
-    JAVASCRIPTCORE_GC_END();
+    if (sweepToggle == DoSweep) {
+        m_markedSpace.sweep();
+        m_markedSpace.shrink();
+    }
 
-    (*m_activityCallback)();
-}
+    size_t proportionalBytes = static_cast<size_t>(1.5 * m_markedSpace.size());
+    m_markedSpace.setHighWaterMark(max(proportionalBytes, minBytesPerCycle));
 
-LiveObjectIterator Heap::primaryHeapBegin()
-{
-    return m_markedSpace.primaryHeapBegin();
-}
+    JAVASCRIPTCORE_GC_END();
 
-LiveObjectIterator Heap::primaryHeapEnd()
-{
-    return m_markedSpace.primaryHeapEnd();
+    (*m_activityCallback)();
 }
 
 void Heap::setActivityCallback(PassOwnPtr<GCActivityCallback> activityCallback)
diff --git a/Source/JavaScriptCore/runtime/Heap.h b/Source/JavaScriptCore/runtime/Heap.h
index f7f4deb..6591a5b 100644
--- a/Source/JavaScriptCore/runtime/Heap.h
+++ b/Source/JavaScriptCore/runtime/Heap.h
@@ -27,89 +27,86 @@
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 
-#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) <= CELL_SIZE, class_fits_in_cell)
-
 namespace JSC {
 
-    class JSValue;
-    class UString;
     class GCActivityCallback;
+    class GlobalCodeBlock;
     class JSCell;
     class JSGlobalData;
     class JSValue;
+    class JSValue;
     class LiveObjectIterator;
-    class MarkedArgumentBuffer;
     class MarkStack;
+    class MarkedArgumentBuffer;
+    class RegisterFile;
+    class UString;
     class WeakGCHandlePool;
 
     typedef std::pair<JSValue, UString> ValueStringPair;
+    typedef HashCountedSet<JSCell*> ProtectCountSet;
+    typedef HashCountedSet<const char*> TypeCountSet;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
 
     class Heap {
         WTF_MAKE_NONCOPYABLE(Heap);
     public:
-        void destroy();
+        static Heap* heap(JSValue); // 0 for immediate values
+        static Heap* heap(JSCell*);
 
-        void* allocate(size_t);
+        static bool isMarked(const JSCell*);
+        static bool testAndSetMarked(const JSCell*);
+        static void setMarked(JSCell*);
+        
+        Heap(JSGlobalData*);
+        ~Heap();
+        void destroy(); // JSGlobalData must call destroy() before ~Heap().
 
-        bool isBusy(); // true if an allocation or collection is in progress
-        void collectAllGarbage();
+        JSGlobalData* globalData() const { return m_globalData; }
+        MarkedSpace& markedSpace() { return m_markedSpace; }
+        MachineStackMarker& machineStackMarker() { return m_machineStackMarker; }
 
         GCActivityCallback* activityCallback();
         void setActivityCallback(PassOwnPtr<GCActivityCallback>);
 
-        static const size_t minExtraCost = 256;
-        static const size_t maxExtraCost = 1024 * 1024;
+        bool isBusy(); // true if an allocation or collection is in progress
+        void* allocate(size_t);
+        void collectAllGarbage();
 
         void reportExtraMemoryCost(size_t cost);
 
-        size_t objectCount() const;
-        MarkedSpace::Statistics statistics() const;
-        size_t size() const;
-
         void protect(JSValue);
-        // Returns true if the value is no longer protected by any protect pointers
-        // (though it may still be alive due to heap/stack references).
-        bool unprotect(JSValue);
+        bool unprotect(JSValue); // True when the protect count drops to 0.
 
-        static Heap* heap(JSValue); // 0 for immediate values
-        static Heap* heap(JSCell*);
+        bool contains(void*);
 
+        size_t size() const;
+        size_t capacity() const;
+        size_t objectCount() const;
         size_t globalObjectCount();
         size_t protectedObjectCount();
         size_t protectedGlobalObjectCount();
-        HashCountedSet<const char*>* protectedObjectTypeCounts();
-        HashCountedSet<const char*>* objectTypeCounts();
-
-        static bool isCellMarked(const JSCell*);
-        static bool checkMarkCell(const JSCell*);
-        static void markCell(JSCell*);
+        PassOwnPtr<TypeCountSet> protectedObjectTypeCounts();
+        PassOwnPtr<TypeCountSet> objectTypeCounts();
 
         WeakGCHandle* addWeakGCHandle(JSCell*);
 
-        void markConservatively(ConservativeSet&, void* start, void* end);
-
-        void pushTempSortVector(WTF::Vector<ValueStringPair>*);
-        void popTempSortVector(WTF::Vector<ValueStringPair>*);        
+        void pushTempSortVector(Vector<ValueStringPair>*);
+        void popTempSortVector(Vector<ValueStringPair>*);
+        
+        HashSet<GlobalCodeBlock*>& codeBlocks() { return m_codeBlocks; }
 
         HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
-
-        JSGlobalData* globalData() const { return m_globalData; }
         
-        LiveObjectIterator primaryHeapBegin();
-        LiveObjectIterator primaryHeapEnd();
+        template <typename Functor> void forEach(Functor&);
         
-        MachineStackMarker& machineStackMarker() { return m_machineStackMarker; }
-
-        MarkedSpace& markedSpace() { return m_markedSpace; }
-
     private:
         friend class JSGlobalData;
-        Heap(JSGlobalData*);
-        ~Heap();
 
-        void recordExtraCost(size_t);
+        static const size_t minExtraCost = 256;
+        static const size_t maxExtraCost = 1024 * 1024;
+
+        void reportExtraMemoryCostSlowCase(size_t);
 
         void markRoots();
         void markProtectedObjects(MarkStack&);
@@ -117,13 +114,19 @@ namespace JSC {
 
         void updateWeakGCHandles();
         WeakGCHandlePool* weakGCHandlePool(size_t index);
+        
+        enum SweepToggle { DoNotSweep, DoSweep };
+        void reset(SweepToggle);
+
+        RegisterFile& registerFile();
 
-        MarkedSpace m_markedSpace;
         OperationInProgress m_operationInProgress;
+        MarkedSpace m_markedSpace;
 
         ProtectCountSet m_protectedValues;
-        WTF::Vector<PageAllocationAligned> m_weakGCHandlePools;
-        WTF::Vector<WTF::Vector<ValueStringPair>* > m_tempSortingVectors;
+        Vector<PageAllocationAligned> m_weakGCHandlePools;
+        Vector<Vector<ValueStringPair>* > m_tempSortingVectors;
+        HashSet<GlobalCodeBlock*> m_codeBlocks;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
@@ -137,25 +140,30 @@ namespace JSC {
         size_t m_extraCost;
     };
 
-    inline bool Heap::isCellMarked(const JSCell* cell)
+    inline bool Heap::isMarked(const JSCell* cell)
     {
-        return MarkedSpace::isCellMarked(cell);
+        return MarkedSpace::isMarked(cell);
     }
 
-    inline bool Heap::checkMarkCell(const JSCell* cell)
+    inline bool Heap::testAndSetMarked(const JSCell* cell)
     {
-        return MarkedSpace::checkMarkCell(cell);
+        return MarkedSpace::testAndSetMarked(cell);
     }
 
-    inline void Heap::markCell(JSCell* cell)
+    inline void Heap::setMarked(JSCell* cell)
     {
-        MarkedSpace::markCell(cell);
+        MarkedSpace::setMarked(cell);
+    }
+
+    inline bool Heap::contains(void* p)
+    {
+        return m_markedSpace.contains(p);
     }
 
     inline void Heap::reportExtraMemoryCost(size_t cost)
     {
         if (cost > minExtraCost) 
-            recordExtraCost(cost);
+            reportExtraMemoryCostSlowCase(cost);
     }
     
     inline WeakGCHandlePool* Heap::weakGCHandlePool(size_t index)
@@ -163,6 +171,11 @@ namespace JSC {
         return static_cast<WeakGCHandlePool*>(m_weakGCHandlePools[index].base());
     }
 
+    template <typename Functor> inline void Heap::forEach(Functor& functor)
+    {
+        m_markedSpace.forEach(functor);
+    }
+
 } // namespace JSC
 
 #endif // Heap_h
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index 0a8d9de..f19ae0d 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -46,7 +46,7 @@ InternalFunction::InternalFunction(NonNullPassRefPtr<Structure> structure)
 InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const Identifier& name)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
-    putDirect(globalData->propertyNames->name, jsString(globalData, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
+    putDirect(*globalData, globalData->propertyNames->name, jsString(globalData, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
 const UString& InternalFunction::name(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 10ded4c..a113e91 100644
--- a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -31,7 +31,7 @@ namespace JSC {
     class JSAPIValueWrapper : public JSCell {
         friend JSValue jsAPIValueWrapper(ExecState*, JSValue);
     public:
-        JSValue value() const { return m_value; }
+        JSValue value() const { return m_value.get(); }
 
         virtual bool isAPIValueWrapper() const { return true; }
 
@@ -44,12 +44,12 @@ namespace JSC {
     private:
         JSAPIValueWrapper(ExecState* exec, JSValue value)
             : JSCell(exec->globalData().apiWrapperStructure.get())
-            , m_value(value)
         {
+            m_value.set(exec->globalData(), this, value);
             ASSERT(!value.isCell());
         }
 
-        JSValue m_value;
+        WriteBarrier<Unknown> m_value;
     };
 
     inline JSValue jsAPIValueWrapper(ExecState* exec, JSValue value)
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 428403d..6fb5ced 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -61,12 +61,12 @@ void JSActivation::markChildren(MarkStack& markStack)
     size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
 
     size_t count = numParametersMinusThis;
-    markStack.appendValues(registerArray, count);
+    markStack.deprecatedAppendValues(registerArray, count);
 
     size_t numVars = d()->functionExecutable->capturedVariableCount();
 
     // Skip the call frame, which sits between the parameters and vars.
-    markStack.appendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
+    markStack.deprecatedAppendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
 }
 
 inline bool JSActivation::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
@@ -132,8 +132,8 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (JSValue* location = getDirectLocation(propertyName)) {
-        slot.setValueSlot(location);
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+        slot.setValue(location->get());
         return true;
     }
 
@@ -144,7 +144,7 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return false;
 }
 
-void JSActivation::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void JSActivation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -155,7 +155,7 @@ void JSActivation::put(ExecState*, const Identifier& propertyName, JSValue value
     // properties are non-standard extensions that other implementations do not
     // expose in the activation object.
     ASSERT(!hasGetterSetterProperties());
-    putDirect(propertyName, value, 0, true, slot);
+    putDirect(exec->globalData(), propertyName, value, 0, true, slot);
 }
 
 // FIXME: Make this function honor ReadOnly (const) and DontEnum
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 556603b..ded6d87 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -188,9 +188,9 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength,
 #endif
         m_storage->m_length = initialLength;
         m_storage->m_numValuesInVector = 0;
-        JSValue* vector = m_storage->m_vector;
+        WriteBarrier<Unknown>* vector = m_storage->m_vector;
         for (size_t i = 0; i < initialCapacity; ++i)
-            vector[i] = JSValue();
+            vector[i].clear();
     }
 
     checkConsistency();
@@ -198,7 +198,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength,
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
-JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
+JSArray::JSArray(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
     unsigned initialCapacity = list.size();
@@ -225,12 +225,12 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 #endif
 
     size_t i = 0;
-    JSValue* vector = m_storage->m_vector;
+    WriteBarrier<Unknown>* vector = m_storage->m_vector;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
-        vector[i] = *it;
+        vector[i].set(globalData, this, *it);
     for (; i < initialStorage; i++)
-        vector[i] = JSValue();
+        vector[i].clear();
 
     checkConsistency();
 
@@ -257,16 +257,16 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
     }
 
     if (i < m_vectorLength) {
-        JSValue& valueSlot = storage->m_vector[i];
-        if (valueSlot) {
-            slot.setValueSlot(&valueSlot);
+        JSValue value = storage->m_vector[i].get();
+        if (value) {
+            slot.setValue(value);
             return true;
         }
     } else if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         if (i >= MIN_SPARSE_ARRAY_INDEX) {
             SparseArrayValueMap::iterator it = map->find(i);
             if (it != map->end()) {
-                slot.setValueSlot(&it->second);
+                slot.setValue(it->second.get());
                 return true;
             }
         }
@@ -305,16 +305,16 @@ bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
         if (i >= storage->m_length)
             return false;
         if (i < m_vectorLength) {
-            JSValue& value = storage->m_vector[i];
+            WriteBarrier<Unknown>& value = storage->m_vector[i];
             if (value) {
-                descriptor.setDescriptor(value, 0);
+                descriptor.setDescriptor(value.get(), 0);
                 return true;
             }
         } else if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
             if (i >= MIN_SPARSE_ARRAY_INDEX) {
                 SparseArrayValueMap::iterator it = map->find(i);
                 if (it != map->end()) {
-                    descriptor.setDescriptor(it->second, 0);
+                    descriptor.setDescriptor(it->second.get(), 0);
                     return true;
                 }
             }
@@ -359,13 +359,13 @@ void JSArray::put(ExecState* exec, unsigned i, JSValue value)
     }
 
     if (i < m_vectorLength) {
-        JSValue& valueSlot = storage->m_vector[i];
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
         if (valueSlot) {
-            valueSlot = value;
+            valueSlot.set(exec->globalData(), this, value);
             checkConsistency();
             return;
         }
-        valueSlot = value;
+        valueSlot.set(exec->globalData(), this, value);
         ++storage->m_numValuesInVector;
         checkConsistency();
         return;
@@ -395,11 +395,11 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
                 storage->m_sparseValueMap = map;
             }
 
-            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, value);
-            if (!result.second) { // pre-existing entry
-                result.first->second = value;
+            WriteBarrier<Unknown> temp;
+            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, temp);
+            result.first->second.set(exec->globalData(), this, value);
+            if (!result.second) // pre-existing entry
                 return;
-            }
 
             size_t capacity = map->capacity();
             if (capacity != storage->reportedMapCapacity) {
@@ -415,7 +415,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     if (!map || map->isEmpty()) {
         if (increaseVectorLength(i + 1)) {
             storage = m_storage;
-            storage->m_vector[i] = value;
+            storage->m_vector[i].set(exec->globalData(), this, value);
             ++storage->m_numValuesInVector;
             checkConsistency();
         } else
@@ -457,18 +457,19 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     storage = m_storage;
     
     unsigned vectorLength = m_vectorLength;
-    JSValue* vector = storage->m_vector;
+    WriteBarrier<Unknown>* vector = storage->m_vector;
 
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
-            vector[j] = JSValue();
+            vector[j].clear();
         if (i > MIN_SPARSE_ARRAY_INDEX)
             map->remove(i);
     } else {
         for (unsigned j = vectorLength; j < max(vectorLength, MIN_SPARSE_ARRAY_INDEX); ++j)
-            vector[j] = JSValue();
+            vector[j].clear();
+        JSGlobalData& globalData = exec->globalData();
         for (unsigned j = max(vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
-            vector[j] = map->take(j);
+            vector[j].set(globalData, this, map->take(j).get());
     }
 
     ASSERT(i < newVectorLength);
@@ -476,7 +477,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     m_vectorLength = newVectorLength;
     storage->m_numValuesInVector = newNumValuesInVector;
 
-    storage->m_vector[i] = value;
+    storage->m_vector[i].set(exec->globalData(), this, value);
 
     checkConsistency();
 
@@ -503,12 +504,12 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     ArrayStorage* storage = m_storage;
     
     if (i < m_vectorLength) {
-        JSValue& valueSlot = storage->m_vector[i];
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
             return false;
         }
-        valueSlot = JSValue();
+        valueSlot.clear();
         --storage->m_numValuesInVector;
         checkConsistency();
         return true;
@@ -605,9 +606,9 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     storage = m_storage = reinterpret_cast_ptr<ArrayStorage*>(static_cast<char*>(baseStorage) + m_indexBias * sizeof(JSValue));
     m_storage->m_allocBase = baseStorage;
 
-    JSValue* vector = storage->m_vector;
+    WriteBarrier<Unknown>* vector = storage->m_vector;
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
-        vector[i] = JSValue();
+        vector[i].clear();
 
     m_vectorLength = newVectorLength;
     
@@ -666,9 +667,9 @@ void JSArray::setLength(unsigned newLength)
     if (newLength < length) {
         unsigned usedVectorLength = min(length, m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
-            JSValue& valueSlot = storage->m_vector[i];
+            WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
-            valueSlot = JSValue();
+            valueSlot.clear();
             storage->m_numValuesInVector -= hadValue;
         }
 
@@ -706,11 +707,11 @@ JSValue JSArray::pop()
     JSValue result;
 
     if (length < m_vectorLength) {
-        JSValue& valueSlot = storage->m_vector[length];
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[length];
         if (valueSlot) {
             --storage->m_numValuesInVector;
-            result = valueSlot;
-            valueSlot = JSValue();
+            result = valueSlot.get();
+            valueSlot.clear();
         } else
             result = jsUndefined();
     } else {
@@ -718,7 +719,7 @@ JSValue JSArray::pop()
         if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
             SparseArrayValueMap::iterator it = map->find(length);
             if (it != map->end()) {
-                result = it->second;
+                result = it->second.get();
                 map->remove(it);
                 if (map->isEmpty()) {
                     delete map;
@@ -742,7 +743,7 @@ void JSArray::push(ExecState* exec, JSValue value)
     ArrayStorage* storage = m_storage;
 
     if (storage->m_length < m_vectorLength) {
-        storage->m_vector[storage->m_length] = value;
+        storage->m_vector[storage->m_length].set(exec->globalData(), this, value);
         ++storage->m_numValuesInVector;
         ++storage->m_length;
         checkConsistency();
@@ -754,7 +755,7 @@ void JSArray::push(ExecState* exec, JSValue value)
         if (!map || map->isEmpty()) {
             if (increaseVectorLength(storage->m_length + 1)) {
                 storage = m_storage;
-                storage->m_vector[storage->m_length] = value;
+                storage->m_vector[storage->m_length].set(exec->globalData(), this, value);
                 ++storage->m_numValuesInVector;
                 ++storage->m_length;
                 checkConsistency();
@@ -857,9 +858,9 @@ void JSArray::unshiftCount(ExecState* exec, int count)
         return;
     }
 
-    JSValue* vector = m_storage->m_vector;
+    WriteBarrier<Unknown>* vector = m_storage->m_vector;
     for (int i = 0; i < count; i++)
-        vector[i] = JSValue();
+        vector[i].clear();
 }
 
 void JSArray::markChildren(MarkStack& markStack)
@@ -941,7 +942,7 @@ void JSArray::sort(ExecState* exec)
     Heap::heap(this)->pushTempSortVector(&values);
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++) {
-        JSValue value = storage->m_vector[i];
+        JSValue value = storage->m_vector[i].get();
         ASSERT(!value.isUndefined());
         values[i].first = value;
     }
@@ -974,9 +975,10 @@ void JSArray::sort(ExecState* exec)
         increaseVectorLength(lengthNotIncludingUndefined);
     if (storage->m_length < lengthNotIncludingUndefined)
         storage->m_length = lengthNotIncludingUndefined;
-        
+
+    JSGlobalData& globalData = exec->globalData();
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
-        storage->m_vector[i] = values[i].first;
+        storage->m_vector[i].set(globalData, this, values[i].first);
 
     Heap::heap(this)->popTempSortVector(&values);
     
@@ -1105,14 +1107,14 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValue v = storage->m_vector[numDefined];
+        JSValue v = storage->m_vector[numDefined].get();
         if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValue v = storage->m_vector[i];
+        JSValue v = storage->m_vector[i].get();
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
@@ -1140,7 +1142,7 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
 
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
-            tree.abstractor().m_nodes[numDefined].value = it->second;
+            tree.abstractor().m_nodes[numDefined].value = it->second.get();
             tree.insert(numDefined);
             ++numDefined;
         }
@@ -1157,18 +1159,19 @@ void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType,
     // Copy the values back into m_storage.
     AVLTree<AVLTreeAbstractorForArrayCompare, 44>::Iterator iter;
     iter.start_iter_least(tree);
+    JSGlobalData& globalData = exec->globalData();
     for (unsigned i = 0; i < numDefined; ++i) {
-        storage->m_vector[i] = tree.abstractor().m_nodes[*iter].value;
+        storage->m_vector[i].set(globalData, this, tree.abstractor().m_nodes[*iter].value);
         ++iter;
     }
 
     // Put undefined values back in.
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
-        storage->m_vector[i] = jsUndefined();
+        storage->m_vector[i].setUndefined();
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        storage->m_vector[i] = JSValue();
+        storage->m_vector[i].clear();
 
     storage->m_numValuesInVector = newUsedVectorLength;
 
@@ -1179,14 +1182,14 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
     ArrayStorage* storage = m_storage;
 
-    JSValue* vector = storage->m_vector;
+    WriteBarrier<Unknown>* vector = storage->m_vector;
     unsigned vectorEnd = min(storage->m_length, m_vectorLength);
     unsigned i = 0;
     for (; i < vectorEnd; ++i) {
-        JSValue& v = vector[i];
+        WriteBarrier<Unknown>& v = vector[i];
         if (!v)
             break;
-        args.append(v);
+        args.append(v.get());
     }
 
     for (; i < storage->m_length; ++i)
@@ -1197,14 +1200,14 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
 {
     ASSERT(m_storage->m_length >= maxSize);
     UNUSED_PARAM(maxSize);
-    JSValue* vector = m_storage->m_vector;
+    WriteBarrier<Unknown>* vector = m_storage->m_vector;
     unsigned vectorEnd = min(maxSize, m_vectorLength);
     unsigned i = 0;
     for (; i < vectorEnd; ++i) {
-        JSValue& v = vector[i];
+        WriteBarrier<Unknown>& v = vector[i];
         if (!v)
             break;
-        buffer[i] = v;
+        buffer[i] = v.get();
     }
 
     for (; i < maxSize; ++i)
@@ -1223,17 +1226,18 @@ unsigned JSArray::compactForSorting()
     unsigned numUndefined = 0;
 
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValue v = storage->m_vector[numDefined];
+        JSValue v = storage->m_vector[numDefined].get();
         if (!v || v.isUndefined())
             break;
     }
+
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValue v = storage->m_vector[i];
+        JSValue v = storage->m_vector[i].get();
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
             else
-                storage->m_vector[numDefined++] = v;
+                storage->m_vector[numDefined++].setWithoutWriteBarrier(v);
         }
     }
 
@@ -1252,16 +1256,16 @@ unsigned JSArray::compactForSorting()
 
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
-            storage->m_vector[numDefined++] = it->second;
+            storage->m_vector[numDefined++].setWithoutWriteBarrier(it->second.get());
 
         delete map;
         storage->m_sparseValueMap = 0;
     }
 
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
-        storage->m_vector[i] = jsUndefined();
+        storage->m_vector[i].setUndefined();
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        storage->m_vector[i] = JSValue();
+        storage->m_vector[i].clear();
 
     storage->m_numValuesInVector = newUsedVectorLength;
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index de28b65..b5caa47 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -27,7 +27,7 @@
 
 namespace JSC {
 
-    typedef HashMap<unsigned, JSValue> SparseArrayValueMap;
+    typedef HashMap<unsigned, WriteBarrier<Unknown> > SparseArrayValueMap;
 
     // This struct holds the actual data values of an array.  A JSArray object points to it's contained ArrayStorage
     // struct by pointing to m_vector.  To access the contained ArrayStorage struct, use the getStorage() and 
@@ -44,7 +44,7 @@ namespace JSC {
 #if CHECK_ARRAY_CONSISTENCY
         bool m_inCompactInitialization;
 #endif
-        JSValue m_vector[1];
+        WriteBarrier<Unknown> m_vector[1];
     };
 
     // The CreateCompact creation mode is used for fast construction of arrays
@@ -67,7 +67,7 @@ namespace JSC {
 
         explicit JSArray(NonNullPassRefPtr<Structure>);
         JSArray(NonNullPassRefPtr<Structure>, unsigned initialLength, ArrayCreationMode);
-        JSArray(NonNullPassRefPtr<Structure>, const ArgList& initialValues);
+        JSArray(JSGlobalData&, NonNullPassRefPtr<Structure>, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -94,32 +94,32 @@ namespace JSC {
         JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
-            return m_storage->m_vector[i];
+            return m_storage->m_vector[i].get();
         }
 
         bool canSetIndex(unsigned i) { return i < m_vectorLength; }
-        void setIndex(unsigned i, JSValue v)
+        void setIndex(JSGlobalData& globalData, unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
             
-            JSValue& x = m_storage->m_vector[i];
+            WriteBarrier<Unknown>& x = m_storage->m_vector[i];
             if (!x) {
                 ArrayStorage *storage = m_storage;
                 ++storage->m_numValuesInVector;
                 if (i >= storage->m_length)
                     storage->m_length = i + 1;
             }
-            x = v;
+            x.set(globalData, this, v);
         }
         
-        void uncheckedSetIndex(unsigned i, JSValue v)
+        void uncheckedSetIndex(JSGlobalData& globalData, unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
             ArrayStorage *storage = m_storage;
 #if CHECK_ARRAY_CONSISTENCY
             ASSERT(storage->m_inCompactInitialization);
 #endif
-            storage->m_vector[i] = v;
+            storage->m_vector[i].set(globalData, this, v);
         }
 
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
@@ -194,13 +194,13 @@ namespace JSC {
         if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
             SparseArrayValueMap::iterator end = map->end();
             for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
-                markStack.append(it->second);
+                markStack.append(&it->second);
         }
     }
 
     inline void MarkStack::markChildren(JSCell* cell)
     {
-        ASSERT(Heap::isCellMarked(cell));
+        ASSERT(Heap::isMarked(cell));
         if (!cell->structure()->typeInfo().overridesMarkChildren()) {
 #ifdef NDEBUG
             asObject(cell)->markChildrenDirect(*this);
@@ -240,7 +240,7 @@ namespace JSC {
                 current.m_values++;
 
                 JSCell* cell;
-                if (!value || !value.isCell() || Heap::checkMarkCell(cell = value.asCell())) {
+                if (!value || !value.isCell() || Heap::testAndSetMarked(cell = value.asCell())) {
                     if (current.m_values == end) {
                         m_markSets.removeLast();
                         continue;
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.cpp b/Source/JavaScriptCore/runtime/JSByteArray.cpp
index 6af9d75..3f7d806 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSByteArray.cpp
@@ -40,7 +40,7 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
     , m_storage(storage)
     , m_classInfo(classInfo)
 {
-    putDirect(exec->globalData().propertyNames->length, jsNumber(m_storage->length()), ReadOnly | DontDelete);
+    putDirect(exec->globalData(), exec->globalData().propertyNames->length, jsNumber(m_storage->length()), ReadOnly | DontDelete);
 }
 
 #if !ASSERT_DISABLED
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 95f4efa..66f6197 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -64,6 +64,7 @@ namespace JSC {
         friend class JSZombie;
         friend class JSGlobalData;
         friend class MarkedSpace;
+        friend class MarkedBlock;
 
     private:
         explicit JSCell(Structure*);
@@ -336,22 +337,50 @@ namespace JSC {
     {
         return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
+    
+    template <typename T> void MarkStack::append(DeprecatedPtr<T>* slot)
+    {
+        internalAppend(slot->get());
+    }
+    
+    template <typename T> void MarkStack::append(WriteBarrierBase<T>* slot)
+    {
+        internalAppend(slot->get());
+    }
 
-    ALWAYS_INLINE void MarkStack::append(JSCell* cell)
+    ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
     {
         ASSERT(!m_isCheckingForDefaultMarkViolation);
         ASSERT(cell);
-        if (Heap::checkMarkCell(cell))
+        if (Heap::testAndSetMarked(cell))
             return;
         if (cell->structure()->typeInfo().type() >= CompoundType)
             m_values.append(cell);
     }
 
-    ALWAYS_INLINE void MarkStack::append(JSValue value)
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+    
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
+    {
+        ASSERT(value);
+        internalAppend(value->jsValue());
+    }
+
+    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
     {
         ASSERT(value);
         if (value.isCell())
-            append(value.asCell());
+            internalAppend(value.asCell());
     }
 
     inline Heap* Heap::heap(JSValue v)
@@ -363,7 +392,7 @@ namespace JSC {
 
     inline Heap* Heap::heap(JSCell* c)
     {
-        return MarkedSpace::cellBlock(c)->heap;
+        return MarkedSpace::heap(c);
     }
     
 #if ENABLE(JSC_ZOMBIES)
@@ -372,6 +401,23 @@ namespace JSC {
         return isCell() && asCell() && asCell()->isZombie();
     }
 #endif
+
+    inline void* MarkedBlock::allocate(size_t& nextCell)
+    {
+        do {
+            ASSERT(nextCell < CELLS_PER_BLOCK);
+            if (!marked.testAndSet(nextCell)) { // Always false for the last cell in the block
+                JSCell* cell = reinterpret_cast<JSCell*>(&cells[nextCell++]);
+                cell->~JSCell();
+                return cell;
+            }
+            nextCell = marked.nextPossiblyUnset(nextCell);
+        } while (nextCell != CELLS_PER_BLOCK);
+        
+        nextCell = 0;
+        return 0;
+    }
+
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 99f8e6f..c569722 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -71,8 +71,8 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
     , m_executable(thunk)
     , m_scopeChain(globalObject->globalScopeChain())
 {
-    putDirect(exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
-    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 #endif
 
@@ -83,9 +83,9 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
 #endif
     , m_scopeChain(globalObject->globalScopeChain())
 {
-    putDirect(exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 #if ENABLE(JIT)
-    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 #else
     UNUSED_PARAM(length);
     UNUSED_PARAM(func);
@@ -99,7 +99,7 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
     , m_scopeChain(scopeChainNode)
 {
     const Identifier& name = static_cast<FunctionExecutable*>(m_executable.get())->name();
-    putDirect(exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
 JSFunction::~JSFunction()
@@ -203,16 +203,16 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertySlot(exec, propertyName, slot);
 
     if (propertyName == exec->propertyNames().prototype) {
-        JSValue* location = getDirectLocation(propertyName);
+        WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName);
 
         if (!location) {
             JSObject* prototype = new (exec) JSObject(scope().globalObject()->emptyObjectStructure());
-            prototype->putDirect(exec->propertyNames().constructor, this, DontEnum);
-            putDirect(exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
+            prototype->putDirect(exec->globalData(), exec->propertyNames().constructor, this, DontEnum);
+            putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
             location = getDirectLocation(propertyName);
         }
 
-        slot.setValueSlot(this, location, offsetForLocation(location));
+        slot.setValue(this, location->get(), offsetForLocation(location));
     }
 
     if (propertyName == exec->propertyNames().arguments) {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index 3928c82..ff88048 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -31,7 +31,6 @@
 
 #include "ArgList.h"
 #include "Heap.h"
-#include "CollectorHeapIterator.h"
 #include "CommonIdentifiers.h"
 #include "FunctionConstructor.h"
 #include "GetterSetter.h"
@@ -87,25 +86,26 @@ void* JSGlobalData::jsFunctionVPtr;
 
 void JSGlobalData::storeVPtrs()
 {
-    CollectorCell cell;
-    void* storage = &cell;
+    // Enough storage to fit a JSArray, JSByteArray, JSString, or JSFunction.
+    // COMPILE_ASSERTS below check that this is true.
+    char storage[64];
 
-    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
+    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(storage), sizeof_JSArray_must_be_less_than_storage);
     JSCell* jsArray = new (storage) JSArray(JSArray::VPtrStealingHack);
     JSGlobalData::jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();
 
-    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(CollectorCell), sizeof_JSByteArray_must_be_less_than_CollectorCell);
+    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(storage), sizeof_JSByteArray_must_be_less_than_storage);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
     JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
     jsByteArray->~JSCell();
 
-    COMPILE_ASSERT(sizeof(JSString) <= sizeof(CollectorCell), sizeof_JSString_must_be_less_than_CollectorCell);
+    COMPILE_ASSERT(sizeof(JSString) <= sizeof(storage), sizeof_JSString_must_be_less_than_storage);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
     JSGlobalData::jsStringVPtr = jsString->vptr();
     jsString->~JSCell();
 
-    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(CollectorCell), sizeof_JSFunction_must_be_less_than_CollectorCell);
+    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(storage), sizeof_JSFunction_must_be_less_than_storage);
     JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
     JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
     jsFunction->~JSCell();
@@ -140,7 +140,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , parser(new Parser)
     , interpreter(new Interpreter)
     , heap(this)
-    , head(0)
     , dynamicGlobalObject(0)
     , firstStringifierToMark(0)
     , cachedUTCOffset(NaN)
@@ -166,11 +165,14 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     if (canUseJIT) {
         m_canUseJIT = kCFBooleanTrue == canUseJIT;
         CFRelease(canUseJIT);
-    } else
-        m_canUseJIT = !getenv("JavaScriptCoreUseJIT");
+    } else {
+      char* canUseJITString = getenv("JavaScriptCoreUseJIT");
+      m_canUseJIT = !canUseJITString || atoi(canUseJITString);
+    }
     CFRelease(canUseJITKey);
 #elif OS(UNIX)
-    m_canUseJIT = !getenv("JavaScriptCoreUseJIT");
+    char* canUseJITString = getenv("JavaScriptCoreUseJIT");
+    m_canUseJIT = !canUseJITString || atoi(canUseJITString);
 #else
     m_canUseJIT = true;
 #endif
@@ -311,21 +313,30 @@ void JSGlobalData::dumpSampleData(ExecState* exec)
     interpreter->dumpSampleData(exec);
 }
 
+class Recompiler {
+public:
+    void operator()(JSCell*);
+};
+
+inline void Recompiler::operator()(JSCell* cell)
+{
+    if (!cell->inherits(&JSFunction::info))
+        return;
+    JSFunction* function = asFunction(cell);
+    if (function->executable()->isHostFunction())
+        return;
+    function->jsExecutable()->discardCode();
+}
+
+
 void JSGlobalData::recompileAllJSFunctions()
 {
     // If JavaScript is running, it's not safe to recompile, since we'll end
     // up throwing away code that is live on the stack.
     ASSERT(!dynamicGlobalObject);
-
-    LiveObjectIterator it = heap.primaryHeapBegin();
-    LiveObjectIterator heapEnd = heap.primaryHeapEnd();
-    for ( ; it != heapEnd; ++it) {
-        if ((*it)->inherits(&JSFunction::info)) {
-            JSFunction* function = asFunction(*it);
-            if (!function->executable()->isHostFunction())
-                function->jsExecutable()->discardCode();
-        }
-    }
+    
+    Recompiler recompiler;
+    heap.forEach(recompiler);
 }
 
 #if ENABLE(REGEXP_TRACING)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 31f41e9..7b69055 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -39,6 +39,7 @@
 #include "SmallStrings.h"
 #include "Terminator.h"
 #include "TimeoutChecker.h"
+#include "WeakGCMap.h"
 #include "WeakRandom.h"
 #include <wtf/BumpPointerAllocator.h>
 #include <wtf/Forward.h>
@@ -72,7 +73,9 @@ namespace JSC {
 #endif
 
     struct HashTable;
-    struct Instruction;    
+    struct Instruction;
+
+    typedef WeakGCMap<JSGlobalObject*, JSGlobalObject> GlobalObjectMap; // FIXME: Would be nice to use a WeakGCSet here.
 
     struct DSTOffsetCache {
         DSTOffsetCache()
@@ -203,14 +206,14 @@ namespace JSC {
         Terminator terminator;
         Heap heap;
 
-        JSValue exception;
+        DeprecatedPtr<Unknown> exception;
 #if ENABLE(JIT)
         ReturnAddressPtr exceptionLocation;
 #endif
 
         HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        JSGlobalObject* head;
+        GlobalObjectMap globalObjects;
         JSGlobalObject* dynamicGlobalObject;
 
         HashSet<JSObject*> stringRecursionCheckVisitedObjects;
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 9b67dbb..f303196 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -80,16 +80,16 @@ static const int initialTickCountThreshold = 255;
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-static inline void markIfNeeded(MarkStack& markStack, JSValue v)
+template <typename T> static inline void markIfNeeded(MarkStack& markStack, WriteBarrier<T>* v)
 {
-    if (v)
+    if (*v)
         markStack.append(v);
 }
 
 static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
 {
-    if (s)
-        markIfNeeded(markStack, s->storedPrototype());
+    if (s && s->storedPrototype())
+        markStack.append(s->storedPrototypeSlot());
 }
 
 JSGlobalObject::~JSGlobalObject()
@@ -104,18 +104,8 @@ JSGlobalObject::~JSGlobalObject()
         (*profiler)->stopProfiling(globalExec(), UString());
     }
 
-    d()->next->d()->prev = d()->prev;
-    d()->prev->d()->next = d()->next;
-    JSGlobalObject*& headObject = head();
-    if (headObject == this)
-        headObject = d()->next;
-    if (headObject == this)
-        headObject = 0;
-
-    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
-        (*it)->clearGlobalObject();
-        
+    d()->globalData->globalObjects.take(this);
+
     RegisterFile& registerFile = globalData().interpreter->registerFile();
     if (registerFile.clearGlobalObject(this))
         registerFile.setNumGlobals(0);
@@ -125,22 +115,15 @@ JSGlobalObject::~JSGlobalObject()
 void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
-
+    
     structure()->disableSpecificFunctionTracking();
 
     d()->globalData = Heap::heap(this)->globalData();
+    d()->globalData->globalObjects.set(this, this);
     d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
     JSGlobalObject::globalExec()->init(0, 0, d()->globalScopeChain.node(), CallFrame::noCaller(), 0, 0);
 
-    if (JSGlobalObject*& headObject = head()) {
-        d()->prev = headObject;
-        d()->next = headObject->d()->next;
-        headObject->d()->next->d()->prev = this;
-        headObject->d()->next = this;
-    } else
-        headObject = d()->next = d()->prev = this;
-
     d()->debugger = 0;
 
     d()->profileGroup = 0;
@@ -202,117 +185,117 @@ void JSGlobalObject::reset(JSValue prototype)
 
     // Prototypes
 
-    d()->functionPrototype = new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(jsNull())); // The real prototype will be set once ObjectPrototype is created.
-    d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype);
-    d()->internalFunctionStructure = InternalFunction::createStructure(d()->functionPrototype);
+    d()->functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(jsNull()))); // The real prototype will be set once ObjectPrototype is created.
+    d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype.get());
+    d()->internalFunctionStructure = InternalFunction::createStructure(d()->functionPrototype.get());
     NativeFunctionWrapper* callFunction = 0;
     NativeFunctionWrapper* applyFunction = 0;
     d()->functionPrototype->addFunctionProperties(exec, this, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
-    d()->callFunction = callFunction;
-    d()->applyFunction = applyFunction;
-    d()->objectPrototype = new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get());
-    d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype);
+    d()->callFunction.set(exec->globalData(), this, callFunction);
+    d()->applyFunction.set(exec->globalData(), this, applyFunction);
+    d()->objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get()));
+    d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype.get());
 
     d()->emptyObjectStructure = d()->objectPrototype->inheritorID();
 
-    d()->functionStructure = JSFunction::createStructure(d()->functionPrototype);
-    d()->callbackFunctionStructure = JSCallbackFunction::createStructure(d()->functionPrototype);
-    d()->argumentsStructure = Arguments::createStructure(d()->objectPrototype);
-    d()->callbackConstructorStructure = JSCallbackConstructor::createStructure(d()->objectPrototype);
-    d()->callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(d()->objectPrototype);
+    d()->functionStructure = JSFunction::createStructure(d()->functionPrototype.get());
+    d()->callbackFunctionStructure = JSCallbackFunction::createStructure(d()->functionPrototype.get());
+    d()->argumentsStructure = Arguments::createStructure(d()->objectPrototype.get());
+    d()->callbackConstructorStructure = JSCallbackConstructor::createStructure(d()->objectPrototype.get());
+    d()->callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(d()->objectPrototype.get());
 
-    d()->arrayPrototype = new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(d()->objectPrototype));
-    d()->arrayStructure = JSArray::createStructure(d()->arrayPrototype);
-    d()->regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(d()->arrayPrototype);
+    d()->arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(d()->objectPrototype.get())));
+    d()->arrayStructure = JSArray::createStructure(d()->arrayPrototype.get());
+    d()->regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(d()->arrayPrototype.get());
 
-    d()->stringPrototype = new (exec) StringPrototype(exec, this, StringPrototype::createStructure(d()->objectPrototype));
-    d()->stringObjectStructure = StringObject::createStructure(d()->stringPrototype);
+    d()->stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(d()->objectPrototype.get())));
+    d()->stringObjectStructure = StringObject::createStructure(d()->stringPrototype.get());
 
-    d()->booleanPrototype = new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
-    d()->booleanObjectStructure = BooleanObject::createStructure(d()->booleanPrototype);
+    d()->booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
+    d()->booleanObjectStructure = BooleanObject::createStructure(d()->booleanPrototype.get());
 
-    d()->numberPrototype = new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
-    d()->numberObjectStructure = NumberObject::createStructure(d()->numberPrototype);
+    d()->numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
+    d()->numberObjectStructure = NumberObject::createStructure(d()->numberPrototype.get());
 
-    d()->datePrototype = new (exec) DatePrototype(exec, this, DatePrototype::createStructure(d()->objectPrototype));
-    d()->dateStructure = DateInstance::createStructure(d()->datePrototype);
+    d()->datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(d()->objectPrototype.get())));
+    d()->dateStructure = DateInstance::createStructure(d()->datePrototype.get());
 
-    d()->regExpPrototype = new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
-    d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype);
+    d()->regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
+    d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype.get());
 
-    d()->methodCallDummy = constructEmptyObject(exec);
+    d()->methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
 
-    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
+    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get());
     d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
 
     // Constructors
 
-    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype, d()->prototypeFunctionStructure.get());
-    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype, d()->prototypeFunctionStructure.get());
-    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
-    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
-    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
-    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(d()->functionPrototype.get()), d()->objectPrototype.get(), d()->prototypeFunctionStructure.get());
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(d()->functionPrototype.get()), d()->functionPrototype.get());
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(d()->functionPrototype.get()), d()->arrayPrototype.get(), d()->prototypeFunctionStructure.get());
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(d()->functionPrototype.get()), d()->prototypeFunctionStructure.get(), d()->stringPrototype.get());
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(d()->functionPrototype.get()), d()->booleanPrototype.get());
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(d()->functionPrototype.get()), d()->numberPrototype.get());
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(d()->functionPrototype.get()), d()->prototypeFunctionStructure.get(), d()->datePrototype.get());
 
-    d()->regExpConstructor = new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(d()->functionPrototype), d()->regExpPrototype);
+    d()->regExpConstructor.set(exec->globalData(), this, new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(d()->functionPrototype.get()), d()->regExpPrototype.get()));
 
-    d()->errorConstructor = new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(d()->functionPrototype), errorPrototype);
+    d()->errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(d()->functionPrototype.get()), errorPrototype));
 
     RefPtr<Structure> nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(errorPrototype);
-    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(d()->functionPrototype);
-    d()->evalErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError");
-    d()->rangeErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError");
-    d()->referenceErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError");
-    d()->syntaxErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError");
-    d()->typeErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError");
-    d()->URIErrorConstructor = new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError");
-
-    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
-    errorPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
+    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(d()->functionPrototype.get());
+    d()->evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
+    d()->rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
+    d()->referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
+    d()->syntaxErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
+    d()->typeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
+    d()->URIErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
+
+    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
+    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
+    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, stringConstructor, DontEnum);
+    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, numberConstructor, DontEnum);
+    d()->datePrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, dateConstructor, DontEnum);
+    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->regExpConstructor.get(), DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->errorConstructor.get(), DontEnum);
 
     // Set global constructors
 
     // FIXME: These properties could be handled by a static hash table.
 
-    putDirectFunctionWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Object"), objectConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Function"), functionConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Array"), arrayConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "String"), stringConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Number"), numberConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Date"), dateConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RegExp"), d()->regExpConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Error"), d()->errorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "EvalError"), d()->evalErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RangeError"), d()->rangeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), d()->typeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), d()->URIErrorConstructor.get(), DontEnum);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
-        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete),
         GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(Inf), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
+        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete)
     };
 
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 
     // Set global functions.
 
-    d()->evalFunction = new (exec) GlobalEvalFunction(exec, this, GlobalEvalFunction::createStructure(d()->functionPrototype), 1, exec->propertyNames().eval, globalFuncEval, this);
-    putDirectFunctionWithoutTransition(exec, d()->evalFunction, DontEnum);
+    d()->evalFunction.set(exec->globalData(), this, new (exec) GlobalEvalFunction(exec, this, GlobalEvalFunction::createStructure(d()->functionPrototype.get()), 1, exec->propertyNames().eval, globalFuncEval, this));
+    putDirectFunctionWithoutTransition(exec, d()->evalFunction.get(), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
@@ -336,7 +319,7 @@ void JSGlobalObject::resetPrototype(JSValue prototype)
     setPrototype(prototype);
 
     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
-    JSObject* objectPrototype = d()->objectPrototype;
+    JSObject* objectPrototype = d()->objectPrototype.get();
     if (oldLastInPrototypeChain != objectPrototype)
         oldLastInPrototypeChain->setPrototype(objectPrototype);
 }
@@ -345,33 +328,29 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
     
-    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
-        (*it)->markAggregate(markStack);
-
-    markIfNeeded(markStack, d()->regExpConstructor);
-    markIfNeeded(markStack, d()->errorConstructor);
-    markIfNeeded(markStack, d()->evalErrorConstructor);
-    markIfNeeded(markStack, d()->rangeErrorConstructor);
-    markIfNeeded(markStack, d()->referenceErrorConstructor);
-    markIfNeeded(markStack, d()->syntaxErrorConstructor);
-    markIfNeeded(markStack, d()->typeErrorConstructor);
-    markIfNeeded(markStack, d()->URIErrorConstructor);
-
-    markIfNeeded(markStack, d()->evalFunction);
-    markIfNeeded(markStack, d()->callFunction);
-    markIfNeeded(markStack, d()->applyFunction);
-
-    markIfNeeded(markStack, d()->objectPrototype);
-    markIfNeeded(markStack, d()->functionPrototype);
-    markIfNeeded(markStack, d()->arrayPrototype);
-    markIfNeeded(markStack, d()->booleanPrototype);
-    markIfNeeded(markStack, d()->stringPrototype);
-    markIfNeeded(markStack, d()->numberPrototype);
-    markIfNeeded(markStack, d()->datePrototype);
-    markIfNeeded(markStack, d()->regExpPrototype);
-
-    markIfNeeded(markStack, d()->methodCallDummy);
+    markIfNeeded(markStack, &d()->regExpConstructor);
+    markIfNeeded(markStack, &d()->errorConstructor);
+    markIfNeeded(markStack, &d()->evalErrorConstructor);
+    markIfNeeded(markStack, &d()->rangeErrorConstructor);
+    markIfNeeded(markStack, &d()->referenceErrorConstructor);
+    markIfNeeded(markStack, &d()->syntaxErrorConstructor);
+    markIfNeeded(markStack, &d()->typeErrorConstructor);
+    markIfNeeded(markStack, &d()->URIErrorConstructor);
+
+    markIfNeeded(markStack, &d()->evalFunction);
+    markIfNeeded(markStack, &d()->callFunction);
+    markIfNeeded(markStack, &d()->applyFunction);
+
+    markIfNeeded(markStack, &d()->objectPrototype);
+    markIfNeeded(markStack, &d()->functionPrototype);
+    markIfNeeded(markStack, &d()->arrayPrototype);
+    markIfNeeded(markStack, &d()->booleanPrototype);
+    markIfNeeded(markStack, &d()->stringPrototype);
+    markIfNeeded(markStack, &d()->numberPrototype);
+    markIfNeeded(markStack, &d()->datePrototype);
+    markIfNeeded(markStack, &d()->regExpPrototype);
+
+    markIfNeeded(markStack, &d()->methodCallDummy);
 
     markIfNeeded(markStack, d()->errorStructure);
     markIfNeeded(markStack, d()->argumentsStructure);
@@ -396,12 +375,12 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     if (d()->registerArray) {
         // Outside the execution of global code, when our variables are torn off,
         // we can mark the torn-off array.
-        markStack.appendValues(d()->registerArray.get(), d()->registerArraySize);
+        markStack.deprecatedAppendValues(d()->registerArray.get(), d()->registerArraySize);
     } else if (d()->registers) {
         // During execution of global code, when our variables are in the register file,
         // the symbol table tells us how many variables there are, and registers
         // points to where they end, and the registers used for execution begin.
-        markStack.appendValues(d()->registers - symbolTable().size(), symbolTable().size());
+        markStack.deprecatedAppendValues(d()->registers - symbolTable().size(), symbolTable().size());
     }
 }
 
@@ -425,9 +404,10 @@ void JSGlobalObject::copyGlobalsFrom(RegisterFile& registerFile)
         d()->registers = 0;
         return;
     }
-    
-    Register* registerArray = copyRegisterArray(registerFile.lastGlobal(), numGlobals);
-    setRegisters(registerArray + numGlobals, registerArray, numGlobals);
+
+    OwnArrayPtr<Register> registerArray = copyRegisterArray(registerFile.lastGlobal(), numGlobals);
+    Register* registers = registerArray.get() + numGlobals;
+    setRegisters(registers, registerArray.release(), numGlobals);
 }
 
 void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 24bc2f8..d13d2da 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -73,26 +73,6 @@ namespace JSC {
                 , destructor(destructor)
                 , registerArraySize(0)
                 , globalScopeChain(NoScopeChain())
-                , regExpConstructor(0)
-                , errorConstructor(0)
-                , evalErrorConstructor(0)
-                , rangeErrorConstructor(0)
-                , referenceErrorConstructor(0)
-                , syntaxErrorConstructor(0)
-                , typeErrorConstructor(0)
-                , URIErrorConstructor(0)
-                , evalFunction(0)
-                , callFunction(0)
-                , applyFunction(0)
-                , objectPrototype(0)
-                , functionPrototype(0)
-                , arrayPrototype(0)
-                , booleanPrototype(0)
-                , stringPrototype(0)
-                , numberPrototype(0)
-                , datePrototype(0)
-                , regExpPrototype(0)
-                , methodCallDummy(0)
                 , weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
             {
             }
@@ -109,29 +89,29 @@ namespace JSC {
             ScopeChain globalScopeChain;
             Register globalCallFrame[RegisterFile::CallFrameHeaderSize];
 
-            RegExpConstructor* regExpConstructor;
-            ErrorConstructor* errorConstructor;
-            NativeErrorConstructor* evalErrorConstructor;
-            NativeErrorConstructor* rangeErrorConstructor;
-            NativeErrorConstructor* referenceErrorConstructor;
-            NativeErrorConstructor* syntaxErrorConstructor;
-            NativeErrorConstructor* typeErrorConstructor;
-            NativeErrorConstructor* URIErrorConstructor;
-
-            GlobalEvalFunction* evalFunction;
-            NativeFunctionWrapper* callFunction;
-            NativeFunctionWrapper* applyFunction;
-
-            ObjectPrototype* objectPrototype;
-            FunctionPrototype* functionPrototype;
-            ArrayPrototype* arrayPrototype;
-            BooleanPrototype* booleanPrototype;
-            StringPrototype* stringPrototype;
-            NumberPrototype* numberPrototype;
-            DatePrototype* datePrototype;
-            RegExpPrototype* regExpPrototype;
-
-            JSObject* methodCallDummy;
+            WriteBarrier<RegExpConstructor> regExpConstructor;
+            WriteBarrier<ErrorConstructor> errorConstructor;
+            WriteBarrier<NativeErrorConstructor> evalErrorConstructor;
+            WriteBarrier<NativeErrorConstructor> rangeErrorConstructor;
+            WriteBarrier<NativeErrorConstructor> referenceErrorConstructor;
+            WriteBarrier<NativeErrorConstructor> syntaxErrorConstructor;
+            WriteBarrier<NativeErrorConstructor> typeErrorConstructor;
+            WriteBarrier<NativeErrorConstructor> URIErrorConstructor;
+
+            WriteBarrier<GlobalEvalFunction> evalFunction;
+            WriteBarrier<NativeFunctionWrapper> callFunction;
+            WriteBarrier<NativeFunctionWrapper> applyFunction;
+
+            WriteBarrier<ObjectPrototype> objectPrototype;
+            WriteBarrier<FunctionPrototype> functionPrototype;
+            WriteBarrier<ArrayPrototype> arrayPrototype;
+            WriteBarrier<BooleanPrototype> booleanPrototype;
+            WriteBarrier<StringPrototype> stringPrototype;
+            WriteBarrier<NumberPrototype> numberPrototype;
+            WriteBarrier<DatePrototype> datePrototype;
+            WriteBarrier<RegExpPrototype> regExpPrototype;
+
+            WriteBarrier<JSObject> methodCallDummy;
 
             RefPtr<Structure> argumentsStructure;
             RefPtr<Structure> arrayStructure;
@@ -155,7 +135,6 @@ namespace JSC {
 
             RefPtr<JSGlobalData> globalData;
 
-            HashSet<GlobalCodeBlock*> codeBlocks;
             WeakMapSet weakMaps;
             WeakRandom weakRandom;
         };
@@ -167,7 +146,7 @@ namespace JSC {
             : JSVariableObject(JSGlobalObject::createStructure(jsNull()), new JSGlobalObjectData(destroyJSGlobalObjectData))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
-            putAnonymousValue(0, this);
+            putThisToAnonymousValue(0);
             init(this);
         }
         
@@ -175,7 +154,7 @@ namespace JSC {
             : JSVariableObject(structure, new JSGlobalObjectData(destroyJSGlobalObjectData))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
-            putAnonymousValue(0, this);
+            putThisToAnonymousValue(0);
             init(this);
         }
 
@@ -184,7 +163,7 @@ namespace JSC {
             : JSVariableObject(structure, data)
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
-            putAnonymousValue(0, this);
+            putThisToAnonymousValue(0);
             init(thisValue);
         }
 
@@ -202,35 +181,31 @@ namespace JSC {
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes);
 
-        // Linked list of all global objects that use the same JSGlobalData.
-        JSGlobalObject*& head() { return d()->globalData->head; }
-        JSGlobalObject* next() { return d()->next; }
-
         // The following accessors return pristine values, even if a script 
         // replaces the global object's associated property.
 
-        RegExpConstructor* regExpConstructor() const { return d()->regExpConstructor; }
+        RegExpConstructor* regExpConstructor() const { return d()->regExpConstructor.get(); }
 
-        ErrorConstructor* errorConstructor() const { return d()->errorConstructor; }
-        NativeErrorConstructor* evalErrorConstructor() const { return d()->evalErrorConstructor; }
-        NativeErrorConstructor* rangeErrorConstructor() const { return d()->rangeErrorConstructor; }
-        NativeErrorConstructor* referenceErrorConstructor() const { return d()->referenceErrorConstructor; }
-        NativeErrorConstructor* syntaxErrorConstructor() const { return d()->syntaxErrorConstructor; }
-        NativeErrorConstructor* typeErrorConstructor() const { return d()->typeErrorConstructor; }
-        NativeErrorConstructor* URIErrorConstructor() const { return d()->URIErrorConstructor; }
+        ErrorConstructor* errorConstructor() const { return d()->errorConstructor.get(); }
+        NativeErrorConstructor* evalErrorConstructor() const { return d()->evalErrorConstructor.get(); }
+        NativeErrorConstructor* rangeErrorConstructor() const { return d()->rangeErrorConstructor.get(); }
+        NativeErrorConstructor* referenceErrorConstructor() const { return d()->referenceErrorConstructor.get(); }
+        NativeErrorConstructor* syntaxErrorConstructor() const { return d()->syntaxErrorConstructor.get(); }
+        NativeErrorConstructor* typeErrorConstructor() const { return d()->typeErrorConstructor.get(); }
+        NativeErrorConstructor* URIErrorConstructor() const { return d()->URIErrorConstructor.get(); }
 
-        GlobalEvalFunction* evalFunction() const { return d()->evalFunction; }
+        GlobalEvalFunction* evalFunction() const { return d()->evalFunction.get(); }
 
-        ObjectPrototype* objectPrototype() const { return d()->objectPrototype; }
-        FunctionPrototype* functionPrototype() const { return d()->functionPrototype; }
-        ArrayPrototype* arrayPrototype() const { return d()->arrayPrototype; }
-        BooleanPrototype* booleanPrototype() const { return d()->booleanPrototype; }
-        StringPrototype* stringPrototype() const { return d()->stringPrototype; }
-        NumberPrototype* numberPrototype() const { return d()->numberPrototype; }
-        DatePrototype* datePrototype() const { return d()->datePrototype; }
-        RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype; }
+        ObjectPrototype* objectPrototype() const { return d()->objectPrototype.get(); }
+        FunctionPrototype* functionPrototype() const { return d()->functionPrototype.get(); }
+        ArrayPrototype* arrayPrototype() const { return d()->arrayPrototype.get(); }
+        BooleanPrototype* booleanPrototype() const { return d()->booleanPrototype.get(); }
+        StringPrototype* stringPrototype() const { return d()->stringPrototype.get(); }
+        NumberPrototype* numberPrototype() const { return d()->numberPrototype.get(); }
+        DatePrototype* datePrototype() const { return d()->datePrototype.get(); }
+        RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype.get(); }
 
-        JSObject* methodCallDummy() const { return d()->methodCallDummy; }
+        JSObject* methodCallDummy() const { return d()->methodCallDummy.get(); }
 
         Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
         Structure* arrayStructure() const { return d()->arrayStructure.get(); }
@@ -270,8 +245,6 @@ namespace JSC {
 
         virtual bool isDynamicScope(bool& requiresDynamicChecks) const;
 
-        HashSet<GlobalCodeBlock*>& codeBlocks() { return d()->codeBlocks; }
-
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
         
@@ -322,7 +295,7 @@ namespace JSC {
         void init(JSObject* thisValue);
         void reset(JSValue prototype);
 
-        void setRegisters(Register* registers, Register* registerArray, size_t count);
+        void setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray, size_t count);
 
         void* operator new(size_t); // can only be allocated with JSGlobalData
     };
@@ -335,7 +308,7 @@ namespace JSC {
         return static_cast<JSGlobalObject*>(asObject(value));
     }
 
-    inline void JSGlobalObject::setRegisters(Register* registers, Register* registerArray, size_t count)
+    inline void JSGlobalObject::setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray, size_t count)
     {
         JSVariableObject::setRegisters(registers, registerArray);
         d()->registerArraySize = count;
@@ -385,7 +358,7 @@ namespace JSC {
     inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
-            return m_prototype;
+            return m_prototype.get();
 
         ASSERT(typeInfo().type() == StringType);
         return exec->lexicalGlobalObject()->stringPrototype();
@@ -457,12 +430,12 @@ namespace JSC {
     {
         MarkedArgumentBuffer values;
         values.append(singleItemValue);
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), values);
     }
 
     inline JSArray* constructArray(ExecState* exec, const ArgList& values)
     {
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), values);
     }
 
     class DynamicGlobalObjectScope {
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index df4be52..0f7a576 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -84,12 +84,13 @@ private:
     public:
         Holder(JSObject*);
 
-        JSObject* object() const { return m_object; }
+        JSObject* object() const { return m_object.get(); }
+        DeprecatedPtr<JSObject>* objectSlot() { return &m_object; }
 
         bool appendNextProperty(Stringifier&, UStringBuilder&);
 
     private:
-        JSObject* const m_object;
+        DeprecatedPtr<JSObject> m_object;
         const bool m_isArray;
         bool m_isJSArray;
         unsigned m_index;
@@ -258,7 +259,7 @@ void Stringifier::markAggregate(MarkStack& markStack)
     for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
         size_t size = m_holderStack.size();
         for (size_t i = 0; i < size; ++i)
-            markStack.append(m_holderStack[i].object());
+            markStack.append(m_holderStack[i].objectSlot());
     }
 }
 
@@ -269,7 +270,7 @@ JSValue Stringifier::stringify(JSValue value)
         return jsNull();
 
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
-    object->putDirect(m_exec->globalData().propertyNames->emptyIdentifier, value);
+    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value);
 
     UStringBuilder result;
     if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
@@ -284,9 +285,6 @@ void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& val
 {
     int length = value.length();
 
-    // String length plus 2 for quote marks plus 8 so we can accomodate a few escaped characters.
-    builder.reserveCapacity(builder.length() + length + 2 + 8);
-
     builder.append('"');
 
     const UChar* data = value.characters();
@@ -502,7 +500,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
     // First time through, initialize.
     if (!m_index) {
         if (m_isArray) {
-            m_isJSArray = isJSArray(&exec->globalData(), m_object);
+            m_isJSArray = isJSArray(&exec->globalData(), m_object.get());
             m_size = m_object->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
             builder.append('[');
         } else {
@@ -535,10 +533,10 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
     if (m_isArray) {
         // Get the value.
         JSValue value;
-        if (m_isJSArray && asArray(m_object)->canGetIndex(index))
-            value = asArray(m_object)->getIndex(index);
+        if (m_isJSArray && asArray(m_object.get())->canGetIndex(index))
+            value = asArray(m_object.get())->getIndex(index);
         else {
-            PropertySlot slot(m_object);
+            PropertySlot slot(m_object.get());
             if (!m_object->getOwnPropertySlot(exec, index, slot))
                 slot.setUndefined();
             if (exec->hadException())
@@ -552,10 +550,10 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
         stringifier.startNewLine(builder);
 
         // Append the stringified value.
-        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, index);
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object.get(), index);
     } else {
         // Get the value.
-        PropertySlot slot(m_object);
+        PropertySlot slot(m_object.get());
         Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
         if (!m_object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
@@ -577,7 +575,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
             builder.append(' ');
 
         // Append the stringified value.
-        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, propertyName);
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object.get(), propertyName);
     }
 
     // From this point on, no access to the this pointer or to any members, because the
@@ -644,13 +642,13 @@ private:
     {
         JSValue args[] = { property, unfiltered };
         ArgList argList(args, 2);
-        return call(m_exec, m_function, m_callType, m_callData, thisObj, argList);
+        return call(m_exec, m_function.get(), m_callType, m_callData, thisObj, argList);
     }
 
     friend class Holder;
 
     ExecState* m_exec;
-    JSObject* m_function;
+    DeprecatedPtr<JSObject> m_function;
     CallType m_callType;
     CallData m_callData;
 };
@@ -729,7 +727,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     array->deleteProperty(m_exec, indexStack.last());
                 else {
                     if (isJSArray(&m_exec->globalData(), array) && array->canSetIndex(indexStack.last()))
-                        array->setIndex(indexStack.last(), filteredValue);
+                        array->setIndex(m_exec->globalData(), indexStack.last(), filteredValue);
                     else
                         array->put(m_exec, indexStack.last(), filteredValue);
                 }
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 6ecc73f..277ffff 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -312,7 +312,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
-        asGetterSetter(object)->setGetter(getterFunction);
+        asGetterSetter(object)->setGetter(exec->globalData(), getterFunction);
         return;
     }
 
@@ -331,7 +331,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
     }
 
     m_structure->setHasGetterSetterProperties(true);
-    getterSetter->setGetter(getterFunction);
+    getterSetter->setGetter(exec->globalData(), getterFunction);
 }
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
@@ -339,7 +339,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     JSValue object = getDirect(propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
-        asGetterSetter(object)->setSetter(setterFunction);
+        asGetterSetter(object)->setSetter(exec->globalData(), setterFunction);
         return;
     }
 
@@ -358,7 +358,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     }
 
     m_structure->setHasGetterSetterProperties(true);
-    getterSetter->setSetter(setterFunction);
+    getterSetter->setSetter(exec->globalData(), setterFunction);
 }
 
 JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
@@ -512,39 +512,39 @@ void JSObject::removeDirect(const Identifier& propertyName)
     if (m_structure->isUncacheableDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
-            putDirectOffset(offset, jsUndefined());
+            putUndefinedAtDirectOffset(offset);
         return;
     }
 
     RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
     setStructure(structure.release());
     if (offset != WTF::notFound)
-        putDirectOffset(offset, jsUndefined());
+        putUndefinedAtDirectOffset(offset);
 }
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
+    putDirectFunction(exec->globalData(), Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunction(ExecState* exec, JSFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
+    putDirectFunction(exec->globalData(), Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, JSFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, function->name(exec)), function, attr);
 }
 
-NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
+NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, WriteBarrierBase<Unknown>* location)
 {
-    if (JSObject* getterFunction = asGetterSetter(*location)->getter()) {
+    if (JSObject* getterFunction = asGetterSetter(location->get())->getter()) {
         if (!structure()->isDictionary())
             slot.setCacheableGetterSlot(this, getterFunction, offsetForLocation(location));
         else
@@ -595,11 +595,11 @@ static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& p
             GetterSetter* accessor = new (exec) GetterSetter(exec);
             if (oldDescriptor.getter()) {
                 attributes |= Getter;
-                accessor->setGetter(asObject(oldDescriptor.getter()));
+                accessor->setGetter(exec->globalData(), asObject(oldDescriptor.getter()));
             }
             if (oldDescriptor.setter()) {
                 attributes |= Setter;
-                accessor->setSetter(asObject(oldDescriptor.setter()));
+                accessor->setSetter(exec->globalData(), asObject(oldDescriptor.setter()));
             }
             target->putWithAttributes(exec, propertyName, accessor, attributes);
             return true;
@@ -720,9 +720,9 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     GetterSetter* getterSetter = asGetterSetter(accessor);
     if (current.attributesEqual(descriptor)) {
         if (descriptor.setter())
-            getterSetter->setSetter(asObject(descriptor.setter()));
+            getterSetter->setSetter(exec->globalData(), asObject(descriptor.setter()));
         if (descriptor.getter())
-            getterSetter->setGetter(asObject(descriptor.getter()));
+            getterSetter->setGetter(exec->globalData(), asObject(descriptor.getter()));
         return true;
     }
     deleteProperty(exec, propertyName);
@@ -731,7 +731,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
         attrs |= Setter;
     if (descriptor.getter())
         attrs |= Getter;
-    putDirect(propertyName, getterSetter, attrs);
+    putDirect(exec->globalData(), propertyName, getterSetter, attrs);
     return true;
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 803abfd..b79249c 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -70,8 +70,8 @@ namespace JSC {
         Setter       = 1 << 6   // property is a setter
     };
 
-    typedef EncodedJSValue* PropertyStorage;
-    typedef const EncodedJSValue* ConstPropertyStorage;
+    typedef WriteBarrierBase<Unknown>* PropertyStorage;
+    typedef const WriteBarrierBase<Unknown>* ConstPropertyStorage;
 
     class JSObject : public JSCell {
         friend class BatchedTransitionOptimizer;
@@ -155,22 +155,22 @@ namespace JSC {
             return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        JSValue* getDirectLocation(const Identifier& propertyName)
+        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName)
         {
             size_t offset = m_structure->get(propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        JSValue* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
         {
             JSCell* specificFunction;
             size_t offset = m_structure->get(propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        size_t offsetForLocation(JSValue* location) const
+        size_t offsetForLocation(WriteBarrierBase<Unknown>* location) const
         {
-            return location - reinterpret_cast<const JSValue*>(propertyStorage());
+            return location - propertyStorage();
         }
 
         void transitionTo(Structure*);
@@ -179,25 +179,26 @@ namespace JSC {
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
-        bool putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
-        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr = 0);
-        bool putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot&);
+        bool putDirect(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr, bool checkReadOnly, PutPropertySlot&);
+        void putDirect(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr = 0);
+        bool putDirect(JSGlobalData&, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
-        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
-        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirectFunction(JSGlobalData&, const Identifier& propertyName, JSCell*, unsigned attr = 0);
+        void putDirectFunction(JSGlobalData&, const Identifier& propertyName, JSCell*, unsigned attr, bool checkReadOnly, PutPropertySlot&);
         void putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr = 0);
         void putDirectFunction(ExecState* exec, JSFunction* function, unsigned attr = 0);
 
-        void putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attr = 0);
-        void putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
+        void putDirectWithoutTransition(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr = 0);
+        void putDirectFunctionWithoutTransition(JSGlobalData&, const Identifier& propertyName, JSCell* value, unsigned attr = 0);
         void putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr = 0);
         void putDirectFunctionWithoutTransition(ExecState* exec, JSFunction* function, unsigned attr = 0);
 
         // Fast access to known property offsets.
-        JSValue getDirectOffset(size_t offset) const { return JSValue::decode(propertyStorage()[offset]); }
-        void putDirectOffset(size_t offset, JSValue value) { propertyStorage()[offset] = JSValue::encode(value); }
+        JSValue getDirectOffset(size_t offset) const { return propertyStorage()[offset].get(); }
+        void putDirectOffset(JSGlobalData& globalData, size_t offset, JSValue value) { propertyStorage()[offset].set(globalData, this, value); }
+        void putUndefinedAtDirectOffset(size_t offset) { propertyStorage()[offset].setUndefined(); }
 
-        void fillGetterPropertySlot(PropertySlot&, JSValue* location);
+        void fillGetterPropertySlot(PropertySlot&, WriteBarrierBase<Unknown>* location);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes = 0);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes = 0);
@@ -225,25 +226,35 @@ namespace JSC {
             return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
-        void flattenDictionaryObject()
+        void flattenDictionaryObject(JSGlobalData& globalData)
         {
-            m_structure->flattenDictionaryStructure(this);
+            m_structure->flattenDictionaryStructure(globalData, this);
         }
 
-        void putAnonymousValue(unsigned index, JSValue value)
+        void putAnonymousValue(JSGlobalData& globalData, unsigned index, JSValue value)
         {
             ASSERT(index < m_structure->anonymousSlotCount());
-            *locationForOffset(index) = value;
+            locationForOffset(index)->set(globalData, this, value);
+        }
+        void clearAnonymousValue(unsigned index)
+        {
+            ASSERT(index < m_structure->anonymousSlotCount());
+            locationForOffset(index)->clear();
         }
         JSValue getAnonymousValue(unsigned index) const
         {
             ASSERT(index < m_structure->anonymousSlotCount());
-            return *locationForOffset(index);
+            return locationForOffset(index)->get();
         }
         
     protected:
         static const unsigned StructureFlags = 0;
         
+        void putThisToAnonymousValue(unsigned index)
+        {
+            locationForOffset(index)->setWithoutWriteBarrier(this);
+        }
+        
     private:
         // Nobody should ever ask any of these questions on something already known to be a JSObject.
         using JSCell::isAPIValueWrapper;
@@ -253,22 +264,22 @@ namespace JSC {
         void getString(ExecState* exec);
         void isObject();
         void isString();
-
+        
         ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
         PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
 
-        const JSValue* locationForOffset(size_t offset) const
+        const WriteBarrierBase<Unknown>* locationForOffset(size_t offset) const
         {
-            return reinterpret_cast<const JSValue*>(&propertyStorage()[offset]);
+            return &propertyStorage()[offset];
         }
 
-        JSValue* locationForOffset(size_t offset)
+        WriteBarrierBase<Unknown>* locationForOffset(size_t offset)
         {
-            return reinterpret_cast<JSValue*>(&propertyStorage()[offset]);
+            return &propertyStorage()[offset];
         }
 
-        bool putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
-        bool putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        bool putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr, bool checkReadOnly, PutPropertySlot&, JSCell*);
+        bool putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr, bool checkReadOnly, PutPropertySlot&);
         void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr = 0);
 
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -278,7 +289,7 @@ namespace JSC {
 
         union {
             PropertyStorage m_externalStorage;
-            EncodedJSValue m_inlineStorage[inlineStorageCapacity];
+            WriteBarrierBase<Unknown> m_inlineStorage[inlineStorageCapacity];
         };
 
         RefPtr<Structure> m_inheritorID;
@@ -372,11 +383,11 @@ inline bool JSValue::inherits(const ClassInfo* classInfo) const
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (JSValue* location = getDirectLocation(propertyName)) {
-        if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter())
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+        if (m_structure->hasGetterSetterProperties() && location->isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
-            slot.setValueSlot(this, location, offsetForLocation(location));
+            slot.setValue(this, location->get(), offsetForLocation(location));
         return true;
     }
 
@@ -450,7 +461,7 @@ inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
     return jsUndefined();
 }
 
-inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
+inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
@@ -467,7 +478,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return false;
 
-            putDirectOffset(offset, value);
+            putDirectOffset(globalData, offset, value);
             // At this point, the objects structure only has a specific value set if previously there
             // had been one set, and if the new value being specified is the same (otherwise we would
             // have despecified, above).  So, if currentSpecificFunction is not set, or if the new
@@ -485,7 +496,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
         ASSERT(offset < m_structure->propertyStorageCapacity());
-        putDirectOffset(offset, value);
+        putDirectOffset(globalData, offset, value);
         // See comment on setNewProperty call below.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
@@ -500,7 +511,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
 
         ASSERT(offset < structure->propertyStorageCapacity());
         setStructure(structure.release());
-        putDirectOffset(offset, value);
+        putDirectOffset(globalData, offset, value);
         // This is a new property; transitions with specific values are not currently cachable,
         // so leave the slot in an uncachable state.
         if (!specificFunction)
@@ -527,7 +538,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         if (currentSpecificFunction) {
             // case (1) Do the put, then return leaving the slot uncachable.
             if (specificFunction == currentSpecificFunction) {
-                putDirectOffset(offset, value);
+                putDirectOffset(globalData, offset, value);
                 return true;
             }
             // case (2) Despecify, fall through to (3).
@@ -536,7 +547,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
 
         // case (3) set the slot, do the put, return.
         slot.setExistingProperty(this, offset);
-        putDirectOffset(offset, value);
+        putDirectOffset(globalData, offset, value);
         return true;
     }
 
@@ -557,7 +568,7 @@ inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue
 
     ASSERT(offset < structure->propertyStorageCapacity());
     setStructure(structure.release());
-    putDirectOffset(offset, value);
+    putDirectOffset(globalData, offset, value);
     // This is a new property; transitions with specific values are not currently cachable,
     // so leave the slot in an uncachable state.
     if (!specificFunction)
@@ -570,61 +581,61 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    return putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
+    return putDirectInternal(globalData, propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
 }
 
 inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     PutPropertySlot slot;
-    putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
+    putDirectInternal(globalData, propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
-inline bool JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline bool JSObject::putDirect(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    return putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
+    return putDirectInternal(globalData, propertyName, value, attributes, checkReadOnly, slot, 0);
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes)
+inline void JSObject::putDirect(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     PutPropertySlot slot;
-    putDirectInternal(propertyName, value, attributes, false, slot, 0);
+    putDirectInternal(globalData, propertyName, value, attributes, false, slot, 0);
 }
 
-inline bool JSObject::putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+inline bool JSObject::putDirect(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    return putDirectInternal(propertyName, value, 0, false, slot, 0);
+    return putDirectInternal(globalData, propertyName, value, 0, false, slot, 0);
 }
 
-inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline void JSObject::putDirectFunction(JSGlobalData& globalData, const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
-    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, value);
+    putDirectInternal(globalData, propertyName, value, attributes, checkReadOnly, slot, value);
 }
 
-inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr)
+inline void JSObject::putDirectFunction(JSGlobalData& globalData, const Identifier& propertyName, JSCell* value, unsigned attr)
 {
     PutPropertySlot slot;
-    putDirectInternal(propertyName, value, attr, false, slot, value);
+    putDirectInternal(globalData, propertyName, value, attr, false, slot, value);
 }
 
-inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attributes)
+inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
     size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
-    putDirectOffset(offset, value);
+    putDirectOffset(globalData, offset, value);
 }
 
-inline void JSObject::putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attributes)
+inline void JSObject::putDirectFunctionWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSCell* value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
     size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
-    putDirectOffset(offset, value);
+    putDirectOffset(globalData, offset, value);
 }
 
 inline void JSObject::transitionTo(Structure* newStructure)
@@ -703,7 +714,7 @@ inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValu
 inline void JSValue::putDirect(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(isCell() && isObject());
-    if (!asObject(asCell())->putDirect(propertyName, value, slot) && slot.isStrictMode())
+    if (!asObject(asCell())->putDirect(exec->globalData(), propertyName, value, slot) && slot.isStrictMode())
         throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
 }
 
@@ -725,7 +736,7 @@ ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_
     bool wasInline = (oldSize == JSObject::inlineStorageCapacity);
 
     PropertyStorage oldPropertyStorage = (wasInline ? m_inlineStorage : m_externalStorage);
-    PropertyStorage newPropertyStorage = new EncodedJSValue[newSize];
+    PropertyStorage newPropertyStorage = new WriteBarrierBase<Unknown>[newSize];
 
     for (unsigned i = 0; i < oldSize; ++i)
        newPropertyStorage[i] = oldPropertyStorage[i];
@@ -740,11 +751,10 @@ ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    markStack.append(prototype());
-    
+    markStack.append(m_structure->storedPrototypeSlot());
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
-    markStack.appendValues(reinterpret_cast<JSValue*>(storage), storageSize);
+    markStack.appendValues(storage, storageSize);
 }
 
 // --- JSValue inlines ----------------------------
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
index e9d6c96..c16acb1 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
@@ -35,7 +35,10 @@ JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject,
 {
     COMPILE_ASSERT(AnonymousSlotCount == 1, AnonymousSlotCount_must_be_one);
     ASSERT(!globalObject || globalObject->isGlobalObject());
-    putAnonymousValue(GlobalObjectSlot, globalObject);
+    if (!globalObject)
+        clearAnonymousValue(GlobalObjectSlot);
+    else
+        putAnonymousValue(globalObject->globalData(), GlobalObjectSlot, globalObject);
 }
 
 JSGlobalObject* JSObjectWithGlobalObject::globalObject() const
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index a5d4da0..6fd28e3 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -40,11 +40,11 @@ inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyN
     , m_cachedStructure(0)
     , m_numCacheableSlots(numCacheableSlots)
     , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
-    , m_jsStrings(new JSValue[m_jsStringsSize])
+    , m_jsStrings(adoptArrayPtr(new WriteBarrier<Unknown>[m_jsStringsSize]))
 {
     PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
     for (size_t i = 0; i < m_jsStringsSize; ++i)
-        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
+        m_jsStrings[i].set(exec->globalData(), this, jsOwnedString(exec, propertyNameVector[i].ustring()));
 }
 
 JSPropertyNameIterator::~JSPropertyNameIterator()
@@ -91,7 +91,7 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
 
 JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
-    JSValue& identifier = m_jsStrings[i];
+    JSValue identifier = m_jsStrings[i].get();
     if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
         return identifier;
 
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 01700ac..cd46243 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -85,7 +85,7 @@ namespace JSC {
         RefPtr<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
-        OwnArrayPtr<JSValue> m_jsStrings;
+        OwnArrayPtr<WriteBarrier<Unknown> > m_jsStrings;
     };
 
     inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 7ab1d1c..80b048e 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSStaticScopeObject);
 void JSStaticScopeObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
-    markStack.append(d()->registerStore.jsValue());
+    markStack.deprecatedAppend(&d()->registerStore);
 }
 
 JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index ba28139..848c431 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -255,7 +255,7 @@ UString JSString::toString(ExecState* exec) const
 
 inline StringObject* StringObject::create(ExecState* exec, JSString* string)
 {
-    return new (exec) StringObject(exec->lexicalGlobalObject()->stringObjectStructure(), string);
+    return new (exec) StringObject(exec->globalData(), exec->lexicalGlobalObject()->stringObjectStructure(), string);
 }
 
 JSObject* JSString::toObject(ExecState* exec) const
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index cad9662..b2e7a51 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -47,6 +47,9 @@ namespace JSC {
     struct ClassInfo;
     struct Instruction;
 
+    template <class T> class DeprecatedPtr;
+    template <class T> class WriteBarrierBase;
+
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
 #if USE(JSVALUE32_64)
@@ -212,6 +215,9 @@ namespace JSC {
 #endif
 
     private:
+        template <class T> JSValue(DeprecatedPtr<T>);
+        template <class T> JSValue(WriteBarrierBase<T>);
+
         enum HashTableDeletedValueTag { HashTableDeletedValue };
         JSValue(HashTableDeletedValueTag);
 
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 3f2e218..96a0ec4 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -89,8 +89,8 @@ namespace JSC {
         {
         }
 
-        Register* copyRegisterArray(Register* src, size_t count);
-        void setRegisters(Register* r, Register* registerArray);
+        PassOwnArrayPtr<Register> copyRegisterArray(Register* src, size_t count);
+        void setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray);
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertyDescriptor&);
@@ -149,18 +149,18 @@ namespace JSC {
         return true;
     }
 
-    inline Register* JSVariableObject::copyRegisterArray(Register* src, size_t count)
+    inline PassOwnArrayPtr<Register> JSVariableObject::copyRegisterArray(Register* src, size_t count)
     {
-        Register* registerArray = new Register[count];
-        memcpy(registerArray, src, count * sizeof(Register));
+        OwnArrayPtr<Register> registerArray = adoptArrayPtr(new Register[count]);
+        memcpy(registerArray.get(), src, count * sizeof(Register));
 
-        return registerArray;
+        return registerArray.release();
     }
 
-    inline void JSVariableObject::setRegisters(Register* registers, Register* registerArray)
+    inline void JSVariableObject::setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray)
     {
-        ASSERT(registerArray != d->registerArray.get());
-        d->registerArray.set(registerArray);
+        ASSERT(registerArray != d->registerArray);
+        d->registerArray = registerArray;
         d->registers = registers;
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.cpp b/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
index 2c39f5c..6c73b2f 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
@@ -30,7 +30,7 @@ void JSWrapperObject::markChildren(MarkStack& markStack)
 {
     JSObject::markChildren(markStack);
     if (m_internalValue)
-        markStack.append(m_internalValue);
+        markStack.append(&m_internalValue);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.h b/Source/JavaScriptCore/runtime/JSWrapperObject.h
index f19cd30..0b0d3fd 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.h
@@ -30,11 +30,11 @@ namespace JSC {
     // Number, Boolean and Date which are wrappers for primitive types.
     class JSWrapperObject : public JSObject {
     protected:
-        explicit JSWrapperObject(NonNullPassRefPtr<Structure>);
+        explicit JSWrapperObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
 
     public:
-        JSValue internalValue() const { return m_internalValue; }
-        void setInternalValue(JSValue);
+        JSValue internalValue() const { return m_internalValue.get(); }
+        void setInternalValue(JSGlobalData&, JSValue);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
@@ -47,21 +47,21 @@ namespace JSC {
     private:
         virtual void markChildren(MarkStack&);
         
-        JSValue m_internalValue;
+        WriteBarrier<Unknown> m_internalValue;
     };
 
-    inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
+    inline JSWrapperObject::JSWrapperObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
         : JSObject(structure)
     {
-        putAnonymousValue(0, jsNull());
+        putAnonymousValue(globalData, 0, jsNull());
     }
 
-    inline void JSWrapperObject::setInternalValue(JSValue value)
+    inline void JSWrapperObject::setInternalValue(JSGlobalData& globalData, JSValue value)
     {
         ASSERT(value);
         ASSERT(!value.isObject());
-        m_internalValue = value;
-        putAnonymousValue(0, value);
+        m_internalValue.set(globalData, this, value);
+        putAnonymousValue(globalData, 0, value);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/LiteralParser.cpp b/Source/JavaScriptCore/runtime/LiteralParser.cpp
index df87e7f..bc2e736 100644
--- a/Source/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/Source/JavaScriptCore/runtime/LiteralParser.cpp
@@ -373,7 +373,7 @@ JSValue LiteralParser::parse(ParserState initialState)
             }
             case DoParseObjectEndExpression:
             {
-                asObject(objectStack.last())->putDirect(identifierStack.last(), lastValue);
+                asObject(objectStack.last())->putDirect(m_exec->globalData(), identifierStack.last(), lastValue);
                 identifierStack.removeLast();
                 if (m_lexer.currentToken().type == TokComma)
                     goto doParseObjectStartExpression;
diff --git a/Source/JavaScriptCore/runtime/Lookup.cpp b/Source/JavaScriptCore/runtime/Lookup.cpp
index dac1c94..3c7d4be 100644
--- a/Source/JavaScriptCore/runtime/Lookup.cpp
+++ b/Source/JavaScriptCore/runtime/Lookup.cpp
@@ -74,7 +74,7 @@ void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject*
     ASSERT(thisObj->structure()->anonymousSlotCount() > 0);
     ASSERT(thisObj->getAnonymousValue(0).isCell() && asObject(thisObj->getAnonymousValue(0).asCell())->isGlobalObject());
     ASSERT(entry->attributes() & Function);
-    JSValue* location = thisObj->getDirectLocation(propertyName);
+    WriteBarrierBase<Unknown>* location = thisObj->getDirectLocation(propertyName);
 
     if (!location) {
         NativeFunctionWrapper* function;
@@ -86,11 +86,11 @@ void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject*
 #endif
             function = new (exec) NativeFunctionWrapper(exec, globalObject, globalObject->prototypeFunctionStructure(), entry->functionLength(), propertyName, entry->function());
 
-        thisObj->putDirectFunction(propertyName, function, entry->attributes());
+        thisObj->putDirectFunction(exec->globalData(), propertyName, function, entry->attributes());
         location = thisObj->getDirectLocation(propertyName);
     }
 
-    slot.setValueSlot(thisObj, location, thisObj->offsetForLocation(location));
+    slot.setValue(thisObj, location->get(), thisObj->offsetForLocation(location));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Lookup.h b/Source/JavaScriptCore/runtime/Lookup.h
index 0d6d98f..43184e5 100644
--- a/Source/JavaScriptCore/runtime/Lookup.h
+++ b/Source/JavaScriptCore/runtime/Lookup.h
@@ -312,9 +312,9 @@ namespace JSC {
 
         if (entry->attributes() & Function) { // function: put as override property
             if (LIKELY(value.isCell()))
-                thisObj->putDirectFunction(propertyName, value.asCell());
+                thisObj->putDirectFunction(exec->globalData(), propertyName, value.asCell());
             else
-                thisObj->putDirect(propertyName, value);
+                thisObj->putDirect(exec->globalData(), propertyName, value);
         } else if (!(entry->attributes() & ReadOnly))
             entry->propertyPutter()(exec, thisObj, value);
 
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
index e52f402..4430947 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "MachineStackMarker.h"
 
+#include "ConservativeSet.h"
 #include "Heap.h"
 #include "JSArray.h"
 #include "JSGlobalData.h"
@@ -73,6 +74,18 @@
 
 namespace JSC {
 
+static inline void swapIfBackwards(void*& begin, void*& end)
+{
+#if OS(WINCE)
+    if (begin <= end)
+        return;
+    std::swap(begin, end);
+#else
+UNUSED_PARAM(begin);
+UNUSED_PARAM(end);
+#endif
+}
+
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
 #if OS(DARWIN)
@@ -196,7 +209,10 @@ void MachineStackMarker::unregisterThread()
 
 void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(ConservativeSet& conservativeSet)
 {
-    m_heap->markConservatively(conservativeSet, m_heap->globalData()->stack().current(), m_heap->globalData()->stack().origin());
+    void* begin = m_heap->globalData()->stack().current();
+    void* end = m_heap->globalData()->stack().origin();
+    swapIfBackwards(begin, end);
+    conservativeSet.add(begin, end);
 }
 
 #if COMPILER(GCC)
@@ -358,10 +374,12 @@ void MachineStackMarker::markOtherThreadConservatively(ConservativeSet& conserva
     size_t regSize = getPlatformThreadRegisters(thread->platformThread, regs);
 
     // mark the thread's registers
-    m_heap->markConservatively(conservativeSet, static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
+    conservativeSet.add(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
 
     void* stackPointer = otherThreadStackPointer(regs);
-    m_heap->markConservatively(conservativeSet, stackPointer, thread->stackBase);
+    void* stackBase = thread->stackBase;
+    swapIfBackwards(stackPointer, stackBase);
+    conservativeSet.add(stackPointer, stackBase);
 
     resumeThread(thread->platformThread);
 }
diff --git a/Source/JavaScriptCore/runtime/MarkStack.h b/Source/JavaScriptCore/runtime/MarkStack.h
index 7946e65..0b7941e 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.h
+++ b/Source/JavaScriptCore/runtime/MarkStack.h
@@ -27,7 +27,8 @@
 #define MarkStack_h
 
 #include "JSValue.h"
-#include <wtf/HashSet.h>
+#include "WriteBarrier.h"
+#include <wtf/Vector.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OSAllocator.h>
 
@@ -49,17 +50,23 @@ namespace JSC {
 #endif
         {
         }
-
-        ALWAYS_INLINE void append(JSValue);
-        void append(JSCell*);
         
-        ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
+        void deprecatedAppend(JSValue*);
+        void deprecatedAppend(JSCell**);
+        void deprecatedAppend(Register*);
+        template <typename T> void append(WriteBarrierBase<T>*);
+        template <typename T> void append(DeprecatedPtr<T>*);
+        
+        ALWAYS_INLINE void deprecatedAppendValues(Register* registers, size_t count, MarkSetProperties properties = NoNullValues)
         {
-            appendValues(reinterpret_cast<JSValue*>(values), count, properties);
+            JSValue* values = reinterpret_cast<JSValue*>(registers);
+            if (count)
+                m_markSets.append(MarkSet(values, values + count, properties));
         }
 
-        ALWAYS_INLINE void appendValues(JSValue* values, size_t count, MarkSetProperties properties = NoNullValues)
+        void appendValues(WriteBarrierBase<Unknown>* barriers, size_t count, MarkSetProperties properties = NoNullValues)
         {
+            JSValue* values = barriers->slot();
             if (count)
                 m_markSets.append(MarkSet(values, values + count, properties));
         }
@@ -74,6 +81,8 @@ namespace JSC {
         }
 
     private:
+        void internalAppend(JSCell*);
+        void internalAppend(JSValue);
         void markChildren(JSCell*);
 
         struct MarkSet {
@@ -188,19 +197,6 @@ namespace JSC {
 #endif
     };
     
-    class ConservativeSet {
-    public:
-        void add(JSCell* cell) { m_set.add(cell); }
-        void mark(MarkStack& markStack)
-        {
-            HashSet<JSCell*>::iterator end = m_set.end();
-            for (HashSet<JSCell*>::iterator it = m_set.begin(); it != end; ++it)
-                markStack.append(*it);
-        }
-
-    private:
-        HashSet<JSCell*> m_set;
-    };
 }
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.cpp b/Source/JavaScriptCore/runtime/MarkedBlock.cpp
new file mode 100644
index 0000000..16053f2
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/MarkedBlock.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MarkedBlock.h"
+
+#include "JSCell.h"
+
+namespace JSC {
+
+MarkedBlock* MarkedBlock::create(JSGlobalData* globalData)
+{
+    PageAllocationAligned allocation = PageAllocationAligned::allocate(BLOCK_SIZE, BLOCK_SIZE, OSAllocator::JSGCHeapPages);
+    if (!static_cast<bool>(allocation))
+        CRASH();
+    return new (allocation.base()) MarkedBlock(allocation, globalData);
+}
+
+void MarkedBlock::destroy(MarkedBlock* block)
+{
+    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i)
+        reinterpret_cast<JSCell*>(&block->cells[i])->~JSCell();
+    block->m_allocation.deallocate();
+}
+
+MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, JSGlobalData* globalData)
+    : m_allocation(allocation)
+    , m_heap(&globalData->heap)
+{
+    marked.set(CELLS_PER_BLOCK - 1);
+
+    Structure* dummyMarkableCellStructure = globalData->dummyMarkableCellStructure.get();
+    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i)
+        new (&cells[i]) JSCell(dummyMarkableCellStructure);
+}
+
+void MarkedBlock::sweep()
+{
+#if !ENABLE(JSC_ZOMBIES)
+    Structure* dummyMarkableCellStructure = m_heap->globalData()->dummyMarkableCellStructure.get();
+#endif
+
+    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i) {
+        if (marked.get(i))
+            continue;
+
+        JSCell* cell = reinterpret_cast<JSCell*>(&cells[i]);
+#if ENABLE(JSC_ZOMBIES)
+        if (!cell->isZombie()) {
+            const ClassInfo* info = cell->classInfo();
+            cell->~JSCell();
+            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
+            marked.set(i);
+        }
+#else
+        cell->~JSCell();
+        new (cell) JSCell(dummyMarkableCellStructure);
+#endif
+    }
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.h b/Source/JavaScriptCore/runtime/MarkedBlock.h
new file mode 100644
index 0000000..f726c25
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/MarkedBlock.h
@@ -0,0 +1,177 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef MarkedBlock_h
+#define MarkedBlock_h
+
+#include <wtf/Bitmap.h>
+#include <wtf/FixedArray.h>
+#include <wtf/PageAllocationAligned.h>
+
+#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) <= MarkedBlock::CELL_SIZE, class_fits_in_cell)
+
+namespace JSC {
+
+    class Heap;
+    class JSCell;
+    class JSGlobalData;
+
+    class MarkedBlock {
+#if OS(WINCE) || OS(SYMBIAN) || PLATFORM(BREWMP)
+        static const size_t BLOCK_SIZE = 64 * 1024; // 64k
+#else
+        static const size_t BLOCK_SIZE = 256 * 1024; // 256k
+#endif
+
+        static const size_t BLOCK_OFFSET_MASK = BLOCK_SIZE - 1;
+        static const size_t BLOCK_MASK = ~BLOCK_OFFSET_MASK;
+        static const size_t MINIMUM_CELL_SIZE = 64;
+        static const size_t CELL_ARRAY_LENGTH = (MINIMUM_CELL_SIZE / sizeof(double)) + (MINIMUM_CELL_SIZE % sizeof(double) != 0 ? sizeof(double) : 0);
+    public:
+        // This is still public for now, for use in assertions.
+        static const size_t CELL_SIZE = CELL_ARRAY_LENGTH * sizeof(double);
+    private:
+        static const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
+        static const size_t CELL_MASK = CELL_SIZE - 1;
+        static const size_t CELL_ALIGN_MASK = ~CELL_MASK;
+        static const size_t BITS_PER_BLOCK = BLOCK_SIZE / CELL_SIZE;
+        static const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(Heap*) - sizeof(WTF::Bitmap<BITS_PER_BLOCK>)) / CELL_SIZE; // Division rounds down intentionally.
+        
+        struct CollectorCell {
+            FixedArray<double, CELL_ARRAY_LENGTH> memory;
+        };
+
+        // Cell size needs to be a power of two for CELL_MASK to be valid.
+        COMPILE_ASSERT(!(sizeof(CollectorCell) % 2), Collector_cell_size_is_power_of_two);
+
+    public:
+        static MarkedBlock* create(JSGlobalData*);
+        static void destroy(MarkedBlock*);
+
+        static bool isCellAligned(const void*);
+        static MarkedBlock* blockFor(const void*);
+        
+        Heap* heap() const;
+        
+        void* allocate(size_t& nextCell);
+        void sweep();
+        
+        bool isEmpty();
+
+        void clearMarks();
+        size_t markCount();
+        size_t size();
+        size_t capacity();
+
+        size_t cellNumber(const void*);
+        bool isMarked(const void*);
+        bool testAndSetMarked(const void*);
+        void setMarked(const void*);
+        
+        template <typename Functor> void forEach(Functor&);
+
+        FixedArray<CollectorCell, CELLS_PER_BLOCK> cells;
+
+    private:
+        MarkedBlock(const PageAllocationAligned&, JSGlobalData*);
+
+        WTF::Bitmap<BITS_PER_BLOCK> marked;
+        PageAllocationAligned m_allocation;
+        Heap* m_heap;
+    };
+
+    inline bool MarkedBlock::isCellAligned(const void* p)
+    {
+        return !((intptr_t)(p) & CELL_MASK);
+    }
+
+    inline MarkedBlock* MarkedBlock::blockFor(const void* p)
+    {
+        return reinterpret_cast<MarkedBlock*>(reinterpret_cast<uintptr_t>(p) & BLOCK_MASK);
+    }
+
+    inline Heap* MarkedBlock::heap() const
+    {
+        return m_heap;
+    }
+
+    inline bool MarkedBlock::isEmpty()
+    {
+        marked.clear(CELLS_PER_BLOCK - 1); // Clear the always-set last bit to avoid confusing isEmpty().
+        bool result = marked.isEmpty();
+        marked.set(CELLS_PER_BLOCK - 1);
+        return result;
+    }
+
+    inline void MarkedBlock::clearMarks()
+    {
+        // allocate() assumes that the last mark bit is always set.
+        marked.clearAll();
+        marked.set(CELLS_PER_BLOCK - 1);
+    }
+    
+    inline size_t MarkedBlock::markCount()
+    {
+        return marked.count() - 1; // The last mark bit is always set.
+    }
+
+    inline size_t MarkedBlock::size()
+    {
+        return markCount() * CELL_SIZE;
+    }
+
+    inline size_t MarkedBlock::capacity()
+    {
+        return BLOCK_SIZE;
+    }
+
+    inline size_t MarkedBlock::cellNumber(const void* cell)
+    {
+        return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
+    }
+
+    inline bool MarkedBlock::isMarked(const void* cell)
+    {
+        return marked.get(cellNumber(cell));
+    }
+
+    inline bool MarkedBlock::testAndSetMarked(const void* cell)
+    {
+        return marked.testAndSet(cellNumber(cell));
+    }
+
+    inline void MarkedBlock::setMarked(const void* cell)
+    {
+        marked.set(cellNumber(cell));
+    }
+
+    template <typename Functor> inline void MarkedBlock::forEach(Functor& functor)
+    {
+        for (size_t i = 0; i < CELLS_PER_BLOCK - 1; ++i) { // The last cell is a dummy place-holder.
+            if (!marked.get(i))
+                continue;
+            functor(reinterpret_cast<JSCell*>(&cells[i]));
+        }
+    }
+
+} // namespace JSC
+
+#endif // MarkedSpace_h
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.cpp b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
index 036c8f0..2f8075d 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
@@ -21,361 +21,118 @@
 #include "config.h"
 #include "MarkedSpace.h"
 
-#include "CollectorHeapIterator.h"
 #include "JSCell.h"
 #include "JSGlobalData.h"
 #include "JSLock.h"
 
-using std::max;
-
 namespace JSC {
 
 class Structure;
 
-// tunable parameters
-
-const size_t GROWTH_FACTOR = 2;
-const size_t LOW_WATER_FACTOR = 4;
-const size_t ALLOCATIONS_PER_COLLECTION = 3600;
-// This value has to be a macro to be used in max() without introducing
-// a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
-#define MIN_ARRAY_SIZE (static_cast<size_t>(14))
-
 MarkedSpace::MarkedSpace(JSGlobalData* globalData)
-    : m_globalData(globalData)
+    : m_waterMark(0)
+    , m_highWaterMark(0)
+    , m_globalData(globalData)
 {
-    memset(&m_heap, 0, sizeof(CollectorHeap));
     allocateBlock();
 }
 
-void MarkedSpace::destroy(ProtectCountSet& protectedValuesCopy)
+void MarkedSpace::destroy()
 {
-    clearMarkBits();
-    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
-    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
-        markCell(it->first);
-
-    m_heap.nextCell = 0;
-    m_heap.nextBlock = 0;
-    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
-    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
-    for ( ; it != end; ++it)
-        (*it)->~JSCell();
+    clearMarks(); // Make sure weak pointers appear dead during destruction.
 
-    protectedValuesEnd = protectedValuesCopy.end();
-    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
-        it->first->~JSCell();
-
-    for (size_t block = 0; block < m_heap.usedBlocks; ++block)
-        m_heap.blocks[block].deallocate();
-
-    fastFree(m_heap.blocks);
-
-    memset(&m_heap, 0, sizeof(CollectorHeap));
+    while (m_heap.blocks.size())
+        freeBlock(0);
+    m_heap.blocks.clear();
 }
 
-NEVER_INLINE CollectorBlock* MarkedSpace::allocateBlock()
+NEVER_INLINE MarkedBlock* MarkedSpace::allocateBlock()
 {
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(BLOCK_SIZE, BLOCK_SIZE, OSAllocator::JSGCHeapPages);
-    CollectorBlock* block = static_cast<CollectorBlock*>(allocation.base());
-    if (!block)
-        CRASH();
-
-    // Initialize block.
-
-    block->heap = &globalData()->heap;
-    clearMarkBits(block);
-
-    Structure* dummyMarkableCellStructure = globalData()->dummyMarkableCellStructure.get();
-    for (size_t i = 0; i < HeapConstants::cellsPerBlock; ++i)
-        new (&block->cells[i]) JSCell(dummyMarkableCellStructure);
-    
-    // Add block to blocks vector.
-
-    size_t numBlocks = m_heap.numBlocks;
-    if (m_heap.usedBlocks == numBlocks) {
-        static const size_t maxNumBlocks = ULONG_MAX / sizeof(PageAllocationAligned) / GROWTH_FACTOR;
-        if (numBlocks > maxNumBlocks)
-            CRASH();
-        numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-        m_heap.numBlocks = numBlocks;
-        m_heap.blocks = static_cast<PageAllocationAligned*>(fastRealloc(m_heap.blocks, numBlocks * sizeof(PageAllocationAligned)));
-    }
-    m_heap.blocks[m_heap.usedBlocks++] = allocation;
-
+    MarkedBlock* block = MarkedBlock::create(globalData());
+    m_heap.blocks.append(block);
     return block;
 }
 
 NEVER_INLINE void MarkedSpace::freeBlock(size_t block)
 {
-    ObjectIterator it(m_heap, block);
-    ObjectIterator end(m_heap, block + 1);
-    for ( ; it != end; ++it)
-        (*it)->~JSCell();
-    m_heap.blocks[block].deallocate();
+    MarkedBlock::destroy(m_heap.blocks[block]);
 
     // swap with the last block so we compact as we go
-    m_heap.blocks[block] = m_heap.blocks[m_heap.usedBlocks - 1];
-    m_heap.usedBlocks--;
-
-    if (m_heap.numBlocks > MIN_ARRAY_SIZE && m_heap.usedBlocks < m_heap.numBlocks / LOW_WATER_FACTOR) {
-        m_heap.numBlocks = m_heap.numBlocks / GROWTH_FACTOR; 
-        m_heap.blocks = static_cast<PageAllocationAligned*>(fastRealloc(m_heap.blocks, m_heap.numBlocks * sizeof(PageAllocationAligned)));
-    }
+    m_heap.blocks[block] = m_heap.blocks.last();
+    m_heap.blocks.removeLast();
 }
 
-void* MarkedSpace::allocate(size_t s)
+void* MarkedSpace::allocate(size_t)
 {
-    ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
-    typedef HeapConstants::Block Block;
-    typedef HeapConstants::Cell Cell;
-    
-    ASSERT(JSLock::lockCount() > 0);
-    ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= HeapConstants::cellSize);
-
-    // Fast case: find the next garbage cell and recycle it.
-
     do {
-        ASSERT(m_heap.nextBlock < m_heap.usedBlocks);
-        Block* block = m_heap.collectorBlock(m_heap.nextBlock);
-        do {
-            ASSERT(m_heap.nextCell < HeapConstants::cellsPerBlock);
-            if (!block->marked.get(m_heap.nextCell)) { // Always false for the last cell in the block
-                Cell* cell = &block->cells[m_heap.nextCell];
+        ASSERT(m_heap.nextBlock < m_heap.blocks.size());
+        MarkedBlock* block = m_heap.collectorBlock(m_heap.nextBlock);
+        if (void* result = block->allocate(m_heap.nextCell))
+            return result;
 
-                JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                imp->~JSCell();
+        m_waterMark += block->capacity();
+    } while (++m_heap.nextBlock != m_heap.blocks.size());
 
-                ++m_heap.nextCell;
-                return cell;
-            }
-            block->marked.advanceToNextPossibleFreeCell(m_heap.nextCell);
-        } while (m_heap.nextCell != HeapConstants::cellsPerBlock);
-        m_heap.nextCell = 0;
-    } while (++m_heap.nextBlock != m_heap.usedBlocks);
-    
-    return 0;
-}
+    if (m_waterMark < m_highWaterMark)
+        return allocateBlock()->allocate(m_heap.nextCell);
 
-void MarkedSpace::resizeBlocks()
-{
-    size_t usedCellCount = markedCells();
-    size_t minCellCount = usedCellCount + max(ALLOCATIONS_PER_COLLECTION, usedCellCount);
-    size_t minBlockCount = (minCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
-
-    size_t maxCellCount = 1.25f * minCellCount;
-    size_t maxBlockCount = (maxCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
-
-    if (m_heap.usedBlocks < minBlockCount)
-        growBlocks(minBlockCount);
-    else if (m_heap.usedBlocks > maxBlockCount)
-        shrinkBlocks(maxBlockCount);
-}
-
-void MarkedSpace::growBlocks(size_t neededBlocks)
-{
-    ASSERT(m_heap.usedBlocks < neededBlocks);
-    while (m_heap.usedBlocks < neededBlocks)
-        allocateBlock();
+    return 0;
 }
 
-void MarkedSpace::shrinkBlocks(size_t neededBlocks)
+void MarkedSpace::shrink()
 {
-    ASSERT(m_heap.usedBlocks > neededBlocks);
-    
-    // Clear the always-on last bit, so isEmpty() isn't fooled by it.
-    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
-        m_heap.collectorBlock(i)->marked.clear(HeapConstants::cellsPerBlock - 1);
-
-    for (size_t i = 0; i != m_heap.usedBlocks && m_heap.usedBlocks != neededBlocks; ) {
-        if (m_heap.collectorBlock(i)->marked.isEmpty()) {
+    for (size_t i = 0; i != m_heap.blocks.size() && m_heap.blocks.size() > 1; ) { // We assume at least one block exists at all times.
+        if (m_heap.collectorBlock(i)->isEmpty()) {
             freeBlock(i);
         } else
             ++i;
     }
-
-    // Reset the always-on last bit.
-    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
-        m_heap.collectorBlock(i)->marked.set(HeapConstants::cellsPerBlock - 1);
 }
 
-inline bool isPointerAligned(void* p)
+void MarkedSpace::clearMarks()
 {
-    return (((intptr_t)(p) & (sizeof(char*) - 1)) == 0);
-}
-
-// Cell size needs to be a power of two for isPossibleCell to be valid.
-COMPILE_ASSERT(sizeof(CollectorCell) % 2 == 0, Collector_cell_size_is_power_of_two);
-
-static inline bool isCellAligned(void *p)
-{
-    return (((intptr_t)(p) & CELL_MASK) == 0);
-}
-
-static inline bool isPossibleCell(void* p)
-{
-    return isCellAligned(p) && p;
-}
-
-void MarkedSpace::markConservatively(ConservativeSet& conservativeSet, void* start, void* end)
-{
-#if OS(WINCE)
-    if (start > end) {
-        void* tmp = start;
-        start = end;
-        end = tmp;
-    }
-#else
-    ASSERT(start <= end);
-#endif
-
-    ASSERT((static_cast<char*>(end) - static_cast<char*>(start)) < 0x1000000);
-    ASSERT(isPointerAligned(start));
-    ASSERT(isPointerAligned(end));
-
-    char** p = static_cast<char**>(start);
-    char** e = static_cast<char**>(end);
-
-    while (p != e) {
-        char* x = *p++;
-        if (isPossibleCell(x)) {
-            uintptr_t xAsBits = reinterpret_cast<uintptr_t>(x);
-            xAsBits &= CELL_ALIGN_MASK;
-
-            uintptr_t offset = xAsBits & BLOCK_OFFSET_MASK;
-            const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
-            if (offset > lastCellOffset)
-                continue;
-
-            CollectorBlock* blockAddr = reinterpret_cast<CollectorBlock*>(xAsBits - offset);
-            size_t usedBlocks = m_heap.usedBlocks;
-            for (size_t block = 0; block < usedBlocks; block++) {
-                if (m_heap.collectorBlock(block) != blockAddr)
-                    continue;
-
-                // x is a pointer into the heap. Now, verify that the cell it
-                // points to is live. (If the cell is dead, we must not mark it,
-                // since that would revive it in a zombie state.)
-                if (block < m_heap.nextBlock) {
-                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
-                    break;
-                }
-                
-                size_t cellOffset = offset / CELL_SIZE;
-                
-                if (block == m_heap.nextBlock && cellOffset < m_heap.nextCell) {
-                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
-                    break;
-                }
-                
-                if (blockAddr->marked.get(cellOffset)) {
-                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
-                    break;
-                }
-            }
-        }
-    }
-}
-
-void MarkedSpace::clearMarkBits()
-{
-    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
-        clearMarkBits(m_heap.collectorBlock(i));
-}
-
-void MarkedSpace::clearMarkBits(CollectorBlock* block)
-{
-    // allocate assumes that the last cell in every block is marked.
-    block->marked.clearAll();
-    block->marked.set(HeapConstants::cellsPerBlock - 1);
-}
-
-size_t MarkedSpace::markedCells(size_t startBlock, size_t startCell) const
-{
-    ASSERT(startBlock <= m_heap.usedBlocks);
-    ASSERT(startCell < HeapConstants::cellsPerBlock);
-
-    if (startBlock >= m_heap.usedBlocks)
-        return 0;
-
-    size_t result = 0;
-    result += m_heap.collectorBlock(startBlock)->marked.count(startCell);
-    for (size_t i = startBlock + 1; i < m_heap.usedBlocks; ++i)
-        result += m_heap.collectorBlock(i)->marked.count();
-
-    return result;
+    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+        m_heap.collectorBlock(i)->clearMarks();
 }
 
 void MarkedSpace::sweep()
 {
-#if !ENABLE(JSC_ZOMBIES)
-    Structure* dummyMarkableCellStructure = globalData()->dummyMarkableCellStructure.get();
-#endif
-
-    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
-    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
-    for ( ; it != end; ++it) {
-        JSCell* cell = *it;
-#if ENABLE(JSC_ZOMBIES)
-        if (!cell->isZombie()) {
-            const ClassInfo* info = cell->classInfo();
-            cell->~JSCell();
-            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
-            Heap::markCell(cell);
-        }
-#else
-        cell->~JSCell();
-        // Callers of sweep assume it's safe to mark any cell in the heap.
-        new (cell) JSCell(dummyMarkableCellStructure);
-#endif
-    }
+    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+        m_heap.collectorBlock(i)->sweep();
 }
 
 size_t MarkedSpace::objectCount() const
 {
-    return m_heap.nextBlock * HeapConstants::cellsPerBlock // allocated full blocks
-           + m_heap.nextCell // allocated cells in current block
-           + markedCells(m_heap.nextBlock, m_heap.nextCell) // marked cells in remainder of m_heap
-           - m_heap.usedBlocks; // 1 cell per block is a dummy sentinel
-}
-
-void MarkedSpace::addToStatistics(Statistics& statistics) const
-{
-    statistics.size += m_heap.usedBlocks * BLOCK_SIZE;
-    statistics.free += m_heap.usedBlocks * BLOCK_SIZE - (objectCount() * HeapConstants::cellSize);
+    size_t result = 0;
+    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+        result += m_heap.collectorBlock(i)->markCount();
+    return result;
 }
 
-MarkedSpace::Statistics MarkedSpace::statistics() const
+size_t MarkedSpace::size() const
 {
-    Statistics statistics = { 0, 0 };
-    addToStatistics(statistics);
-    return statistics;
+    size_t result = 0;
+    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+        result += m_heap.collectorBlock(i)->size();
+    return result;
 }
 
-size_t MarkedSpace::size() const
+size_t MarkedSpace::capacity() const
 {
-    return m_heap.usedBlocks * BLOCK_SIZE;
+    size_t result = 0;
+    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+        result += m_heap.collectorBlock(i)->capacity();
+    return result;
 }
 
 void MarkedSpace::reset()
 {
     m_heap.nextCell = 0;
     m_heap.nextBlock = 0;
+    m_waterMark = 0;
 #if ENABLE(JSC_ZOMBIES)
     sweep();
 #endif
-    resizeBlocks();
-}
-
-LiveObjectIterator MarkedSpace::primaryHeapBegin()
-{
-    return LiveObjectIterator(m_heap, 0);
-}
-
-LiveObjectIterator MarkedSpace::primaryHeapEnd()
-{
-    return LiveObjectIterator(m_heap, m_heap.usedBlocks);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.h b/Source/JavaScriptCore/runtime/MarkedSpace.h
index af312b5..fcb93b7 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.h
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.h
@@ -23,7 +23,9 @@
 #define MarkedSpace_h
 
 #include "MachineStackMarker.h"
+#include "MarkedBlock.h"
 #include "PageAllocationAligned.h"
+#include <wtf/Bitmap.h>
 #include <wtf/FixedArray.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/Noncopyable.h>
@@ -31,7 +33,6 @@
 
 namespace JSC {
 
-    class CollectorBlock;
     class Heap;
     class JSCell;
     class JSGlobalData;
@@ -39,182 +40,115 @@ namespace JSC {
     class MarkStack;
     class WeakGCHandle;
 
-#if OS(WINCE) || OS(SYMBIAN) || PLATFORM(BREWMP)
-    const size_t BLOCK_SIZE = 64 * 1024; // 64k
-#else
-    const size_t BLOCK_SIZE = 256 * 1024; // 256k
-#endif
-
-    typedef HashCountedSet<JSCell*> ProtectCountSet;
-
     struct CollectorHeap {
-        size_t nextBlock;
-        size_t nextCell;
-        PageAllocationAligned* blocks;
+        CollectorHeap()
+            : nextBlock(0)
+            , nextCell(0)
+        {
+        }
         
-        size_t numBlocks;
-        size_t usedBlocks;
-
-        CollectorBlock* collectorBlock(size_t index) const
+        MarkedBlock* collectorBlock(size_t index) const
         {
-            return static_cast<CollectorBlock*>(blocks[index].base());
+            return blocks[index];
         }
+
+        size_t nextBlock;
+        size_t nextCell;
+        Vector<MarkedBlock*> blocks;
     };
 
     class MarkedSpace {
         WTF_MAKE_NONCOPYABLE(MarkedSpace);
     public:
-        MarkedSpace(JSGlobalData*);
-        void destroy(ProtectCountSet&);
-
-        void* allocate(size_t);
-
-        size_t objectCount() const;
-        struct Statistics {
-            size_t size;
-            size_t free;
-        };
-        Statistics statistics() const;
-        size_t size() const;
-
         static Heap* heap(JSCell*);
 
-        static bool isCellMarked(const JSCell*);
-        static bool checkMarkCell(const JSCell*);
-        static void markCell(JSCell*);
-
-        WeakGCHandle* addWeakGCHandle(JSCell*);
-
-        void markConservatively(ConservativeSet&, void* start, void* end);
+        static bool isMarked(const JSCell*);
+        static bool testAndSetMarked(const JSCell*);
+        static void setMarked(const JSCell*);
 
-        static bool isNumber(JSCell*);
-        
-        LiveObjectIterator primaryHeapBegin();
-        LiveObjectIterator primaryHeapEnd();
+        MarkedSpace(JSGlobalData*);
+        void destroy();
 
         JSGlobalData* globalData() { return m_globalData; }
 
-        static CollectorBlock* cellBlock(const JSCell*);
-        static size_t cellOffset(const JSCell*);
+        size_t highWaterMark() { return m_highWaterMark; }
+        void setHighWaterMark(size_t highWaterMark) { m_highWaterMark = highWaterMark; }
+
+        void* allocate(size_t);
 
+        void clearMarks();
+        void markRoots();
         void reset();
         void sweep();
+        void shrink();
 
-        NEVER_INLINE CollectorBlock* allocateBlock();
-        NEVER_INLINE void freeBlock(size_t);
-        void resizeBlocks();
-        void growBlocks(size_t neededBlocks);
-        void shrinkBlocks(size_t neededBlocks);
-        void clearMarkBits();
-        void clearMarkBits(CollectorBlock*);
-        size_t markedCells(size_t startBlock = 0, size_t startCell = 0) const;
+        size_t size() const;
+        size_t capacity() const;
+        size_t objectCount() const;
 
-        void addToStatistics(Statistics&) const;
+        bool contains(const void*);
 
-        void markRoots();
+        template<typename Functor> void forEach(Functor&);
 
     private:
-        CollectorHeap m_heap;
-        JSGlobalData* m_globalData;
-    };
+        NEVER_INLINE MarkedBlock* allocateBlock();
+        NEVER_INLINE void freeBlock(size_t);
 
-    // tunable parameters
-    // derived constants
-    const size_t BLOCK_OFFSET_MASK = BLOCK_SIZE - 1;
-    const size_t BLOCK_MASK = ~BLOCK_OFFSET_MASK;
-    const size_t MINIMUM_CELL_SIZE = 64;
-    const size_t CELL_ARRAY_LENGTH = (MINIMUM_CELL_SIZE / sizeof(double)) + (MINIMUM_CELL_SIZE % sizeof(double) != 0 ? sizeof(double) : 0);
-    const size_t CELL_SIZE = CELL_ARRAY_LENGTH * sizeof(double);
-    const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
-    const size_t CELL_MASK = CELL_SIZE - 1;
-    const size_t CELL_ALIGN_MASK = ~CELL_MASK;
-    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(MarkedSpace*)) * 8 * CELL_SIZE / (8 * CELL_SIZE + 1) / CELL_SIZE; // one bitmap byte can represent 8 cells.
-    
-    const size_t BITMAP_SIZE = (CELLS_PER_BLOCK + 7) / 8;
-    const size_t BITMAP_WORDS = (BITMAP_SIZE + 3) / sizeof(uint32_t);
-
-    struct CollectorBitmap {
-        FixedArray<uint32_t, BITMAP_WORDS> bits;
-        bool get(size_t n) const { return !!(bits[n >> 5] & (1 << (n & 0x1F))); } 
-        void set(size_t n) { bits[n >> 5] |= (1 << (n & 0x1F)); } 
-        bool getset(size_t n)
-        {
-            unsigned i = (1 << (n & 0x1F));
-            uint32_t& b = bits[n >> 5];
-            bool r = !!(b & i);
-            b |= i;
-            return r;
-        } 
-        void clear(size_t n) { bits[n >> 5] &= ~(1 << (n & 0x1F)); } 
-        void clearAll() { memset(bits.data(), 0, sizeof(bits)); }
-        ALWAYS_INLINE void advanceToNextPossibleFreeCell(size_t& startCell)
-        {
-            if (!~bits[startCell >> 5])
-                startCell = (startCell & (~0x1F)) + 32;
-            else
-                ++startCell;
-        }
-        size_t count(size_t startCell = 0)
-        {
-            size_t result = 0;
-            for ( ; (startCell & 0x1F) != 0; ++startCell) {
-                if (get(startCell))
-                    ++result;
-            }
-            for (size_t i = startCell >> 5; i < BITMAP_WORDS; ++i)
-                result += WTF::bitCount(bits[i]);
-            return result;
-        }
-        size_t isEmpty() // Much more efficient than testing count() == 0.
-        {
-            for (size_t i = 0; i < BITMAP_WORDS; ++i)
-                if (bits[i] != 0)
-                    return false;
-            return true;
-        }
-    };
-  
-    struct CollectorCell {
-        FixedArray<double, CELL_ARRAY_LENGTH> memory;
-    };
+        void clearMarks(MarkedBlock*);
 
-    class CollectorBlock {
-    public:
-        FixedArray<CollectorCell, CELLS_PER_BLOCK> cells;
-        CollectorBitmap marked;
-        Heap* heap;
+        CollectorHeap m_heap;
+        size_t m_waterMark;
+        size_t m_highWaterMark;
+        JSGlobalData* m_globalData;
     };
 
-    struct HeapConstants {
-        static const size_t cellSize = CELL_SIZE;
-        static const size_t cellsPerBlock = CELLS_PER_BLOCK;
-        typedef CollectorCell Cell;
-        typedef CollectorBlock Block;
-    };
+    inline Heap* MarkedSpace::heap(JSCell* cell)
+    {
+        return MarkedBlock::blockFor(cell)->heap();
+    }
 
-    inline CollectorBlock* MarkedSpace::cellBlock(const JSCell* cell)
+    inline bool MarkedSpace::isMarked(const JSCell* cell)
     {
-        return reinterpret_cast<CollectorBlock*>(reinterpret_cast<uintptr_t>(cell) & BLOCK_MASK);
+        return MarkedBlock::blockFor(cell)->isMarked(cell);
     }
 
-    inline size_t MarkedSpace::cellOffset(const JSCell* cell)
+    inline bool MarkedSpace::testAndSetMarked(const JSCell* cell)
     {
-        return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
+        return MarkedBlock::blockFor(cell)->testAndSetMarked(cell);
     }
 
-    inline bool MarkedSpace::isCellMarked(const JSCell* cell)
+    inline void MarkedSpace::setMarked(const JSCell* cell)
     {
-        return cellBlock(cell)->marked.get(cellOffset(cell));
+        MarkedBlock::blockFor(cell)->setMarked(cell);
     }
 
-    inline bool MarkedSpace::checkMarkCell(const JSCell* cell)
+    inline bool MarkedSpace::contains(const void* x)
     {
-        return cellBlock(cell)->marked.getset(cellOffset(cell));
+        if (!MarkedBlock::isCellAligned(x))
+            return false;
+
+        MarkedBlock* block = MarkedBlock::blockFor(x);
+        if (!block)
+            return false;
+
+        size_t size = m_heap.blocks.size();
+        for (size_t i = 0; i < size; i++) {
+            if (block != m_heap.collectorBlock(i))
+                continue;
+
+            // x is a pointer into the heap. Now, verify that the cell it
+            // points to is live. (If the cell is dead, we must not mark it,
+            // since that would revive it in a zombie state.)
+            return block->isMarked(x);
+        }
+        
+        return false;
     }
 
-    inline void MarkedSpace::markCell(JSCell* cell)
+    template <typename Functor> inline void MarkedSpace::forEach(Functor& functor)
     {
-        cellBlock(cell)->marked.set(cellOffset(cell));
+        for (size_t i = 0; i < m_heap.blocks.size(); ++i)
+            m_heap.collectorBlock(i)->forEach(functor);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MathObject.cpp b/Source/JavaScriptCore/runtime/MathObject.cpp
index 080d7d2..c79316b 100644
--- a/Source/JavaScriptCore/runtime/MathObject.cpp
+++ b/Source/JavaScriptCore/runtime/MathObject.cpp
@@ -89,14 +89,14 @@ const ClassInfo MathObject::info = { "Math", 0, 0, ExecState::mathTable };
 MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
-    putDirectWithoutTransition(Identifier(exec, "E"), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LN2"), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LN10"), jsNumber(log(10.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LOG2E"), jsNumber(1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "LOG10E"), jsNumber(1.0 / log(10.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(piDouble), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "E"), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LN2"), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LN10"), jsNumber(log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LOG2E"), jsNumber(1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LOG10E"), jsNumber(1.0 / log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "PI"), jsNumber(piDouble), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "SQRT1_2"), jsNumber(sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "SQRT2"), jsNumber(sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
 }
 
 // ECMA 15.8
diff --git a/Source/JavaScriptCore/runtime/MemoryStatistics.cpp b/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
index 06a319b..86101f5 100644
--- a/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
+++ b/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
@@ -32,11 +32,6 @@
 
 namespace JSC {
 
-MarkedSpace::Statistics heapStatistics(JSGlobalData* commonGlobalData)
-{
-    return commonGlobalData->heap.statistics();
-}        
-
 GlobalMemoryStatistics globalMemoryStatistics() 
 {
     GlobalMemoryStatistics stats;
diff --git a/Source/JavaScriptCore/runtime/MemoryStatistics.h b/Source/JavaScriptCore/runtime/MemoryStatistics.h
index 2659702..d4b8b6f 100644
--- a/Source/JavaScriptCore/runtime/MemoryStatistics.h
+++ b/Source/JavaScriptCore/runtime/MemoryStatistics.h
@@ -37,7 +37,6 @@ struct GlobalMemoryStatistics {
     size_t JITBytes;
 };
 
-MarkedSpace::Statistics heapStatistics(JSGlobalData* commonGlobalData);
 GlobalMemoryStatistics globalMemoryStatistics();
 
 }
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index eb508eb..421eecf 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -37,8 +37,8 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject*
 {
     NativeErrorPrototype* prototype = new (exec) NativeErrorPrototype(exec, globalObject, prototypeStructure, nameAndMessage, this);
 
-    putDirect(exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
-    putDirect(exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
+    putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
     m_errorStructure = ErrorInstance::createStructure(prototype);
 }
 
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index 540220a..4e10268 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -34,9 +34,9 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorPrototype);
 NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& nameAndMessage, NativeErrorConstructor* constructor)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
-    putDirect(exec->propertyNames().name, jsString(exec, nameAndMessage), 0);
-    putDirect(exec->propertyNames().message, jsString(exec, nameAndMessage), 0);
-    putDirect(exec->propertyNames().constructor, constructor, DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().name, jsString(exec, nameAndMessage), 0);
+    putDirect(exec->globalData(), exec->propertyNames().message, jsString(exec, nameAndMessage), 0);
+    putDirect(exec->globalData(), exec->propertyNames().constructor, constructor, DontEnum);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.cpp b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
index 5369ca0..7cec875 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -58,10 +58,10 @@ NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObje
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, numberPrototype->info.className))
 {
     // Number.Prototype
-    putDirectWithoutTransition(exec->propertyNames().prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 }
 
 bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -102,9 +102,9 @@ static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&)
 // ECMA 15.7.1
 static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* exec)
 {
-    NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
     double n = exec->argumentCount() ? exec->argument(0).toNumber(exec) : 0;
-    object->setInternalValue(jsNumber(n));
+    object->setInternalValue(exec->globalData(), jsNumber(n));
     return JSValue::encode(object);
 }
 
diff --git a/Source/JavaScriptCore/runtime/NumberObject.cpp b/Source/JavaScriptCore/runtime/NumberObject.cpp
index 1a7e44c..603c2f0 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.cpp
+++ b/Source/JavaScriptCore/runtime/NumberObject.cpp
@@ -31,8 +31,8 @@ ASSERT_CLASS_FITS_IN_CELL(NumberObject);
 
 const ClassInfo NumberObject::info = { "Number", 0, 0, 0 };
 
-NumberObject::NumberObject(NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+NumberObject::NumberObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
+    : JSWrapperObject(globalData, structure)
 {
 }
 
@@ -43,8 +43,8 @@ JSValue NumberObject::getJSNumber()
 
 NumberObject* constructNumber(ExecState* exec, JSValue number)
 {
-    NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    object->setInternalValue(number);
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
+    object->setInternalValue(exec->globalData(), number);
     return object;
 }
 
diff --git a/Source/JavaScriptCore/runtime/NumberObject.h b/Source/JavaScriptCore/runtime/NumberObject.h
index e82b593..044f490 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.h
+++ b/Source/JavaScriptCore/runtime/NumberObject.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class NumberObject : public JSWrapperObject {
     public:
-        explicit NumberObject(NonNullPassRefPtr<Structure>);
+        explicit NumberObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
 
         static const ClassInfo info;
 
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index 0b86c00..fbe6992 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -47,9 +47,9 @@ static EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*);
 // ECMA 15.7.4
 
 NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
-    : NumberObject(structure)
+    : NumberObject(exec->globalData(), structure)
 {
-    setInternalValue(jsNumber(0));
+    setInternalValue(exec->globalData(), jsNumber(0));
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index ca3dcd7..f31da67 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -47,10 +47,10 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObje
 : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "Object"))
 {
     // ECMA 15.2.3.1
-    putDirectWithoutTransition(exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
     
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
     
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
@@ -117,15 +117,15 @@ EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState
 
     JSObject* description = constructEmptyObject(exec);
     if (!descriptor.isAccessorDescriptor()) {
-        description->putDirect(exec->propertyNames().value, descriptor.value() ? descriptor.value() : jsUndefined(), 0);
-        description->putDirect(exec->propertyNames().writable, jsBoolean(descriptor.writable()), 0);
+        description->putDirect(exec->globalData(), exec->propertyNames().value, descriptor.value() ? descriptor.value() : jsUndefined(), 0);
+        description->putDirect(exec->globalData(), exec->propertyNames().writable, jsBoolean(descriptor.writable()), 0);
     } else {
-        description->putDirect(exec->propertyNames().get, descriptor.getter() ? descriptor.getter() : jsUndefined(), 0);
-        description->putDirect(exec->propertyNames().set, descriptor.setter() ? descriptor.setter() : jsUndefined(), 0);
+        description->putDirect(exec->globalData(), exec->propertyNames().get, descriptor.getter() ? descriptor.getter() : jsUndefined(), 0);
+        description->putDirect(exec->globalData(), exec->propertyNames().set, descriptor.setter() ? descriptor.setter() : jsUndefined(), 0);
     }
     
-    description->putDirect(exec->propertyNames().enumerable, jsBoolean(descriptor.enumerable()), 0);
-    description->putDirect(exec->propertyNames().configurable, jsBoolean(descriptor.configurable()), 0);
+    description->putDirect(exec->globalData(), exec->propertyNames().enumerable, jsBoolean(descriptor.enumerable()), 0);
+    description->putDirect(exec->globalData(), exec->propertyNames().configurable, jsBoolean(descriptor.configurable()), 0);
 
     return JSValue::encode(description);
 }
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 1252345..6e84123 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -429,7 +429,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (cell->structure()->isDictionary()) {
-                asObject(cell)->flattenDictionaryObject();
+                asObject(cell)->flattenDictionaryObject(callFrame->globalData());
                 if (slotBase == cell)
                     slotOffset = cell->structure()->get(propertyName); 
             }
@@ -454,7 +454,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (base->structure()->isDictionary())
-                asObject(base)->flattenDictionaryObject();
+                asObject(base)->flattenDictionaryObject(callFrame->globalData());
 
             ++count;
         }
@@ -471,7 +471,7 @@ namespace JSC {
         PropertySlot slot;
         JSObject* base;
         while (true) {
-            base = *iter;
+            base = iter->get();
             if (next == end)
                 return isStrictPut ? JSValue() : base;
             if (base->getPropertySlot(callFrame, property, slot))
diff --git a/Source/JavaScriptCore/runtime/PropertySlot.h b/Source/JavaScriptCore/runtime/PropertySlot.h
index de9ddc9..cdda6ff 100644
--- a/Source/JavaScriptCore/runtime/PropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PropertySlot.h
@@ -32,8 +32,7 @@ namespace JSC {
     class ExecState;
     class JSObject;
 
-#define JSC_VALUE_SLOT_MARKER 0
-#define JSC_REGISTER_SLOT_MARKER reinterpret_cast<GetValueFunc>(1)
+#define JSC_VALUE_MARKER 0
 #define INDEX_GETTER_MARKER reinterpret_cast<GetValueFunc>(2)
 #define GETTER_FUNCTION_MARKER reinterpret_cast<GetValueFunc>(3)
 
@@ -67,10 +66,8 @@ namespace JSC {
 
         JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
-            if (m_getValue == JSC_VALUE_SLOT_MARKER)
-                return *m_data.valueSlot;
-            if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue();
+            if (m_getValue == JSC_VALUE_MARKER)
+                return m_value;
             if (m_getValue == INDEX_GETTER_MARKER)
                 return m_getIndexValue(exec, slotBase(), index());
             if (m_getValue == GETTER_FUNCTION_MARKER)
@@ -80,10 +77,8 @@ namespace JSC {
 
         JSValue getValue(ExecState* exec, unsigned propertyName) const
         {
-            if (m_getValue == JSC_VALUE_SLOT_MARKER)
-                return *m_data.valueSlot;
-            if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue();
+            if (m_getValue == JSC_VALUE_MARKER)
+                return m_value;
             if (m_getValue == INDEX_GETTER_MARKER)
                 return m_getIndexValue(exec, m_slotBase, m_data.index);
             if (m_getValue == GETTER_FUNCTION_MARKER)
@@ -100,41 +95,32 @@ namespace JSC {
             return m_offset;
         }
 
-        void setValueSlot(JSValue* valueSlot) 
+        void setValue(JSValue slotBase, JSValue value)
         {
-            ASSERT(valueSlot);
-            clearBase();
+            ASSERT(value);
             clearOffset();
-            m_getValue = JSC_VALUE_SLOT_MARKER;
-            m_data.valueSlot = valueSlot;
-        }
-        
-        void setValueSlot(JSValue slotBase, JSValue* valueSlot)
-        {
-            ASSERT(valueSlot);
-            m_getValue = JSC_VALUE_SLOT_MARKER;
+            m_getValue = JSC_VALUE_MARKER;
             m_slotBase = slotBase;
-            m_data.valueSlot = valueSlot;
+            m_value = value;
         }
         
-        void setValueSlot(JSValue slotBase, JSValue* valueSlot, size_t offset)
+        void setValue(JSValue slotBase, JSValue value, size_t offset)
         {
-            ASSERT(valueSlot);
-            m_getValue = JSC_VALUE_SLOT_MARKER;
+            ASSERT(value);
+            m_getValue = JSC_VALUE_MARKER;
             m_slotBase = slotBase;
-            m_data.valueSlot = valueSlot;
+            m_value = value;
             m_offset = offset;
             m_cachedPropertyType = Value;
         }
-        
+
         void setValue(JSValue value)
         {
             ASSERT(value);
             clearBase();
             clearOffset();
-            m_getValue = JSC_VALUE_SLOT_MARKER;
+            m_getValue = JSC_VALUE_MARKER;
             m_value = value;
-            m_data.valueSlot = &m_value;
         }
 
         void setRegisterSlot(Register* registerSlot)
@@ -142,8 +128,8 @@ namespace JSC {
             ASSERT(registerSlot);
             clearBase();
             clearOffset();
-            m_getValue = JSC_REGISTER_SLOT_MARKER;
-            m_data.registerSlot = registerSlot;
+            m_getValue = JSC_VALUE_MARKER;
+            m_value = registerSlot->jsValue();
         }
 
         void setCustom(JSValue slotBase, GetValueFunc getValue)
@@ -251,8 +237,6 @@ namespace JSC {
         JSValue m_slotBase;
         union {
             JSObject* getterFunc;
-            JSValue* valueSlot;
-            Register* registerSlot;
             unsigned index;
         } m_data;
 
diff --git a/Source/JavaScriptCore/runtime/PrototypeFunction.cpp b/Source/JavaScriptCore/runtime/PrototypeFunction.cpp
index 3529080..95e1033 100644
--- a/Source/JavaScriptCore/runtime/PrototypeFunction.cpp
+++ b/Source/JavaScriptCore/runtime/PrototypeFunction.cpp
@@ -37,7 +37,7 @@ PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObje
     , m_function(function)
 {
     ASSERT_ARG(function, function);
-    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 
 PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> prototypeFunctionStructure, int length, const Identifier& name, NativeFunction function)
@@ -45,7 +45,7 @@ PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObje
     , m_function(function)
 {
     ASSERT_ARG(function, function);
-    putDirect(exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
     
 CallType PrototypeFunction::getCallData(CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/PutPropertySlot.h b/Source/JavaScriptCore/runtime/PutPropertySlot.h
index 4b0b394..4c9e0e6 100644
--- a/Source/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PutPropertySlot.h
@@ -45,14 +45,14 @@ namespace JSC {
         {
         }
 
-        void setExistingProperty(JSObject* base, size_t offset)
+        void setExistingProperty(DeprecatedPtr<JSObject> base, size_t offset)
         {
             m_type = ExistingProperty;
             m_base = base;
             m_offset = offset;
         }
 
-        void setNewProperty(JSObject* base, size_t offset)
+        void setNewProperty(DeprecatedPtr<JSObject> base, size_t offset)
         {
             m_type = NewProperty;
             m_base = base;
@@ -60,7 +60,7 @@ namespace JSC {
         }
 
         Type type() const { return m_type; }
-        JSObject* base() const { return m_base; }
+        JSObject* base() const { return m_base.get(); }
 
         bool isStrictMode() const { return m_isStrictMode; }
         bool isCacheable() const { return m_type != Uncachable; }
@@ -70,7 +70,7 @@ namespace JSC {
         }
     private:
         Type m_type;
-        JSObject* m_base;
+        DeprecatedPtr<JSObject> m_base;
         size_t m_offset;
         bool m_isStrictMode;
     };
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 31a1abe..95ce5e9 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -25,6 +25,7 @@
 
 #include "Lexer.h"
 #include "yarr/Yarr.h"
+#include "yarr/YarrJIT.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -230,11 +231,12 @@ void RegExp::matchCompareWithInterpreter(const UString& s, int startOffset, int*
 #if ENABLE(YARR_JIT)
         Yarr::YarrCodeBlock& codeBlock = m_representation->m_regExpJITCode;
 
-        char jitAddr[20];
+        const size_t jitAddrSize = 20;
+        char jitAddr[jitAddrSize];
         if (m_state == JITCode)
-            sprintf(jitAddr, "fallback");
+            snprintf(jitAddr, jitAddrSize, "fallback");
         else
-            sprintf(jitAddr, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.getAddr()));
+            snprintf(jitAddr, jitAddrSize, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.getAddr()));
 #else
         const char* jitAddr = "JIT Off";
 #endif
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 30d3eab..1b30514 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -100,10 +100,10 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObje
     , d(adoptPtr(new RegExpConstructorPrivate))
 {
     // ECMA 15.10.5.1 RegExp.prototype
-    putDirectWithoutTransition(exec->propertyNames().prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
 
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.cpp b/Source/JavaScriptCore/runtime/ScopeChain.cpp
index 54c5082..976cff6 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/Source/JavaScriptCore/runtime/ScopeChain.cpp
@@ -35,12 +35,12 @@ void ScopeChainNode::print() const
 {
     ScopeChainIterator scopeEnd = end();
     for (ScopeChainIterator scopeIter = begin(); scopeIter != scopeEnd; ++scopeIter) {
-        JSObject* o = *scopeIter;
+        DeprecatedPtr<JSObject> o = *scopeIter;
         PropertyNameArray propertyNames(globalObject->globalExec());
         o->getPropertyNames(globalObject->globalExec(), propertyNames);
         PropertyNameArray::const_iterator propEnd = propertyNames.end();
 
-        fprintf(stderr, "----- [scope %p] -----\n", o);
+        fprintf(stderr, "----- [scope %p] -----\n", o.get());
         for (PropertyNameArray::const_iterator propIter = propertyNames.begin(); propIter != propEnd; propIter++) {
             Identifier name = *propIter;
             fprintf(stderr, "%s, ", name.ustring().utf8().data());
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index b104e75..11f3692 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -21,6 +21,7 @@
 #ifndef ScopeChain_h
 #define ScopeChain_h
 
+#include "WriteBarrier.h"
 #include <wtf/FastAllocBase.h>
 
 namespace JSC {
@@ -52,7 +53,6 @@ namespace JSC {
         ~ScopeChainNode()
         {
             next = 0;
-            object = 0;
             globalData = 0;
             globalObject = 0;
             globalThis = 0;
@@ -60,7 +60,7 @@ namespace JSC {
 #endif
 
         ScopeChainNode* next;
-        JSObject* object;
+        DeprecatedPtr<JSObject> object;
         JSGlobalData* globalData;
         JSGlobalObject* globalObject;
         JSObject* globalThis;
@@ -131,8 +131,8 @@ namespace JSC {
         {
         }
 
-        JSObject* const & operator*() const { return m_node->object; }
-        JSObject* const * operator->() const { return &(operator*()); }
+        DeprecatedPtr<JSObject> const & operator*() const { return m_node->object; }
+        DeprecatedPtr<JSObject> const * operator->() const { return &(operator*()); }
     
         ScopeChainIterator& operator++() { m_node = m_node->next; return *this; }
 
@@ -195,7 +195,7 @@ namespace JSC {
 
         ScopeChainNode* node() const { return m_node; }
 
-        JSObject* top() const { return m_node->object; }
+        JSObject* top() const { return m_node->object.get(); }
 
         ScopeChainIterator begin() const { return m_node->begin(); }
         ScopeChainIterator end() const { return m_node->end(); }
diff --git a/Source/JavaScriptCore/runtime/ScopeChainMark.h b/Source/JavaScriptCore/runtime/ScopeChainMark.h
index 984d101..faa4824 100644
--- a/Source/JavaScriptCore/runtime/ScopeChainMark.h
+++ b/Source/JavaScriptCore/runtime/ScopeChainMark.h
@@ -28,7 +28,7 @@ namespace JSC {
     inline void ScopeChain::markAggregate(MarkStack& markStack) const
     {
         for (ScopeChainNode* n = m_node; n; n = n->next)
-            markStack.append(n->object);
+            markStack.append(&n->object);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index 5614932..9b193f5 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -35,9 +35,9 @@ namespace JSC {
 
 static const unsigned numCharactersToStore = 0x100;
 
-static inline bool isMarked(JSString* string)
+static inline bool isMarked(JSCell* string)
 {
-    return string && Heap::isCellMarked(string);
+    return string && Heap::isMarked(string);
 }
 
 class SmallStringsStorage {
@@ -83,9 +83,9 @@ void SmallStrings::markChildren(MarkStack& markStack)
        so, it's probably reasonable to mark the rest. If not, we clear the cache.
      */
 
-    bool isAnyStringMarked = isMarked(m_emptyString);
+    bool isAnyStringMarked = isMarked(m_emptyString.get());
     for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
-        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i].get());
     
     if (!isAnyStringMarked) {
         clear();
@@ -93,10 +93,10 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
     
     if (m_emptyString)
-        markStack.append(m_emptyString);
+        markStack.append(&m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
         if (m_singleCharacterStrings[i])
-            markStack.append(m_singleCharacterStrings[i]);
+            markStack.append(&m_singleCharacterStrings[i]);
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index ac84fe8..ee795b6 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -27,6 +27,7 @@
 #define SmallStrings_h
 
 #include "UString.h"
+#include "WriteBarrier.h"
 #include <wtf/FixedArray.h>
 #include <wtf/OwnPtr.h>
 
@@ -47,13 +48,13 @@ namespace JSC {
         {
             if (!m_emptyString)
                 createEmptyString(globalData);
-            return m_emptyString;
+            return m_emptyString.get();
         }
         JSString* singleCharacterString(JSGlobalData* globalData, unsigned char character)
         {
             if (!m_singleCharacterStrings[character])
                 createSingleCharacterString(globalData, character);
-            return m_singleCharacterStrings[character];
+            return m_singleCharacterStrings[character].get();
         }
 
         StringImpl* singleCharacterStringRep(unsigned char character);
@@ -63,14 +64,14 @@ namespace JSC {
 
         unsigned count() const;
 #if ENABLE(JIT)
-        JSString** singleCharacterStrings() { return m_singleCharacterStrings.data(); }
+        JSCell** singleCharacterStrings() { return m_singleCharacterStrings[0].slot(); }
 #endif
     private:
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
 
-        JSString* m_emptyString;
-        FixedArray<JSString*, 0x100> m_singleCharacterStrings;
+        DeprecatedPtr<JSString> m_emptyString;
+        FixedArray<DeprecatedPtr<JSString>, 0x100> m_singleCharacterStrings;
         OwnPtr<SmallStringsStorage> m_storage;
     };
 
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index 101650c..604473b 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -53,7 +53,7 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, stringPrototype->classInfo()->className))
 {
     // ECMA 15.5.3.1 String.prototype
-    putDirectWithoutTransition(exec->propertyNames().prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
 
     // ECMA 15.5.3.2 fromCharCode()
 #if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
@@ -62,7 +62,7 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 #endif
     // no. of arguments for constructor
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 }
 
 // ECMA 15.5.2
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index dc27618..eb9cfa3 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -30,21 +30,21 @@ ASSERT_CLASS_FITS_IN_CELL(StringObject);
 const ClassInfo StringObject::info = { "String", 0, 0, 0 };
 
 StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+    : JSWrapperObject(exec->globalData(), structure)
 {
-    setInternalValue(jsEmptyString(exec));
+    setInternalValue(exec->globalData(), jsEmptyString(exec));
 }
 
-StringObject::StringObject(NonNullPassRefPtr<Structure> structure, JSString* string)
-    : JSWrapperObject(structure)
+StringObject::StringObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, JSString* string)
+    : JSWrapperObject(globalData, structure)
 {
-    setInternalValue(string);
+    setInternalValue(globalData, string);
 }
 
 StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
-    : JSWrapperObject(structure)
+    : JSWrapperObject(exec->globalData(), structure)
 {
-    setInternalValue(jsString(exec, string));
+    setInternalValue(exec->globalData(), jsString(exec, string));
 }
 
 bool StringObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/StringObject.h b/Source/JavaScriptCore/runtime/StringObject.h
index e3add77..03488f5 100644
--- a/Source/JavaScriptCore/runtime/StringObject.h
+++ b/Source/JavaScriptCore/runtime/StringObject.h
@@ -53,7 +53,7 @@ namespace JSC {
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
-        StringObject(NonNullPassRefPtr<Structure>, JSString*);
+        StringObject(JSGlobalData&, NonNullPassRefPtr<Structure>, JSString*);
   };
 
     StringObject* asStringObject(JSValue);
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 8b3d056..545c93e 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -134,9 +134,9 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
 StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
     : StringObject(exec, structure)
 {
-    putAnonymousValue(0, globalObject);
+    putAnonymousValue(exec->globalData(), 0, globalObject);
     // The constructor will be added later, after StringConstructor has been built
-    putDirectWithoutTransition(exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
 }
 
 bool StringPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index 0179eed..e8f5d7a 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -242,7 +242,7 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anony
     m_transitions.m_singleTransition = 0;
 
     ASSERT(m_prototype);
-    ASSERT(m_prototype.isObject() || m_prototype.isNull());
+    ASSERT(m_prototype->isObject() || m_prototype->isNull());
 
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -476,7 +476,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
         return transition.release();
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
+    RefPtr<Structure> transition = create(structure->m_prototype.get(), structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
@@ -595,7 +595,7 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
+    RefPtr<Structure> transition = create(structure->m_prototype.get(), structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
@@ -620,7 +620,7 @@ PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* st
     return toDictionaryTransition(structure, UncachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
+PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObject* object)
 {
     ASSERT(isDictionary());
     if (isUncacheableDictionary()) {
@@ -651,7 +651,7 @@ PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
         
         // Copy the original property values into their final locations
         for (unsigned i = 0; i < propertyCount; i++)
-            object->putDirectOffset(anonymousSlotCount + i, values[i]);
+            object->putDirectOffset(globalData, anonymousSlotCount + i, values[i]);
 
         if (m_propertyTable->deletedOffsets) {
             delete m_propertyTable->deletedOffsets;
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index f480051..77724ac 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -80,7 +80,7 @@ namespace JSC {
         static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
 
-        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
+        PassRefPtr<Structure> flattenDictionaryStructure(JSGlobalData&, JSObject*);
 
         ~Structure();
 
@@ -94,7 +94,8 @@ namespace JSC {
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
-        JSValue storedPrototype() const { return m_prototype; }
+        JSValue storedPrototype() const { return m_prototype.get(); }
+        DeprecatedPtr<Unknown>* storedPrototypeSlot() { return &m_prototype; }
         JSValue prototypeForLookup(ExecState*) const;
         StructureChain* prototypeChain(ExecState*) const;
 
@@ -206,7 +207,7 @@ namespace JSC {
 
         TypeInfo m_typeInfo;
 
-        JSValue m_prototype;
+        DeprecatedPtr<Unknown> m_prototype;
         mutable RefPtr<StructureChain> m_cachedPrototypeChain;
 
         RefPtr<Structure> m_previous;
diff --git a/Source/JavaScriptCore/runtime/StructureChain.cpp b/Source/JavaScriptCore/runtime/StructureChain.cpp
index 085876c..e4523c3 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.cpp
+++ b/Source/JavaScriptCore/runtime/StructureChain.cpp
@@ -38,7 +38,7 @@ StructureChain::StructureChain(Structure* head)
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
     
-    m_vector.set(new RefPtr<Structure>[size + 1]);
+    m_vector = adoptArrayPtr(new RefPtr<Structure>[size + 1]);
 
     size_t i = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
diff --git a/Source/JavaScriptCore/runtime/WeakGCMap.h b/Source/JavaScriptCore/runtime/WeakGCMap.h
index 316794f..7bf4503 100644
--- a/Source/JavaScriptCore/runtime/WeakGCMap.h
+++ b/Source/JavaScriptCore/runtime/WeakGCMap.h
@@ -46,22 +46,31 @@ class WeakGCMap {
     */
 
 public:
-    typedef typename HashMap<KeyType, MappedType>::iterator iterator;
-    typedef typename HashMap<KeyType, MappedType>::const_iterator const_iterator;
+    typedef typename HashMap<KeyType, DeprecatedPtr<MappedType> >::iterator iterator;
+    typedef typename HashMap<KeyType, DeprecatedPtr<MappedType> >::const_iterator const_iterator;
     
     bool isEmpty() { return m_map.isEmpty(); }
     void clear() { m_map.clear(); }
 
-    MappedType get(const KeyType& key) const;
-    pair<iterator, bool> set(const KeyType&, const MappedType&); 
-    MappedType take(const KeyType& key);
+    MappedType* get(const KeyType&) const;
+    pair<iterator, bool> set(const KeyType&, MappedType*); 
+    MappedType* take(const KeyType&);
 
     // These unchecked functions provide access to a value even if the value's
     // mark bit is not set. This is used, among other things, to retrieve values
     // during the GC mark phase, which begins by clearing all mark bits.
-
-    MappedType uncheckedGet(const KeyType& key) const { return m_map.get(key); }
-    bool uncheckedRemove(const KeyType&, const MappedType&);
+    
+    size_t uncheckedSize() { return m_map.size(); }
+
+    MappedType* uncheckedGet(const KeyType& key) const { return m_map.get(key).get(); }
+    DeprecatedPtr<MappedType>* uncheckedGetSlot(const KeyType& key)
+    {
+        iterator iter = m_map.find(key);
+        if (iter == m_map.end())
+            return 0;
+        return &iter->second;
+    }
+    bool uncheckedRemove(const KeyType&, MappedType*);
 
     iterator uncheckedBegin() { return m_map.begin(); }
     iterator uncheckedEnd() { return m_map.end(); }
@@ -69,51 +78,54 @@ public:
     const_iterator uncheckedBegin() const { return m_map.begin(); }
     const_iterator uncheckedEnd() const { return m_map.end(); }
 
+    bool isValid(iterator it) const { return Heap::isMarked(it->second.get()); }
+    bool isValid(const_iterator it) const { return Heap::isMarked(it->second.get()); }
+
 private:
-    HashMap<KeyType, MappedType> m_map;
+    HashMap<KeyType, DeprecatedPtr<MappedType> > m_map;
 };
 
 template<typename KeyType, typename MappedType>
-inline MappedType WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
+inline MappedType* WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
 {
-    MappedType result = m_map.get(key);
-    if (result == HashTraits<MappedType>::emptyValue())
+    MappedType* result = m_map.get(key).get();
+    if (result == HashTraits<MappedType*>::emptyValue())
         return result;
-    if (!Heap::isCellMarked(result))
-        return HashTraits<MappedType>::emptyValue();
+    if (!Heap::isMarked(result))
+        return HashTraits<MappedType*>::emptyValue();
     return result;
 }
 
 template<typename KeyType, typename MappedType>
-MappedType WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
+MappedType* WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
 {
-    MappedType result = m_map.take(key);
-    if (result == HashTraits<MappedType>::emptyValue())
+    MappedType* result = m_map.take(key).get();
+    if (result == HashTraits<MappedType*>::emptyValue())
         return result;
-    if (!Heap::isCellMarked(result))
-        return HashTraits<MappedType>::emptyValue();
+    if (!Heap::isMarked(result))
+        return HashTraits<MappedType*>::emptyValue();
     return result;
 }
 
 template<typename KeyType, typename MappedType>
-pair<typename HashMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, const MappedType& value)
+pair<typename WeakGCMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, MappedType* value)
 {
-    Heap::markCell(value); // If value is newly allocated, it's not marked, so mark it now.
+    Heap::setMarked(value); // If value is newly allocated, it's not marked, so mark it now.
     pair<iterator, bool> result = m_map.add(key, value);
     if (!result.second) { // pre-existing entry
-        result.second = !Heap::isCellMarked(result.first->second);
+        result.second = !Heap::isMarked(result.first->second.get());
         result.first->second = value;
     }
     return result;
 }
 
 template<typename KeyType, typename MappedType>
-bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, const MappedType& value)
+bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, MappedType* value)
 {
     iterator it = m_map.find(key);
     if (it == m_map.end())
         return false;
-    if (it->second != value)
+    if (it->second.get() != value)
         return false;
     m_map.remove(it);
     return true;
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
new file mode 100644
index 0000000..64150ed
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WriteBarrier_h
+#define WriteBarrier_h
+
+#include "JSValue.h"
+
+namespace JSC {
+class JSCell;
+class JSGlobalData;
+
+typedef enum { } Unknown;
+
+template <class T> class DeprecatedPtr {
+public:
+    DeprecatedPtr() : m_cell(0) { }
+    DeprecatedPtr(T* cell) : m_cell(reinterpret_cast<JSCell*>(cell)) { }
+    T* get() const { return reinterpret_cast<T*>(m_cell); }
+    T* operator*() const { return static_cast<T*>(m_cell); }
+    T* operator->() const { return static_cast<T*>(m_cell); }
+    
+    JSCell** slot() { return &m_cell; }
+    
+    typedef T* (DeprecatedPtr::*UnspecifiedBoolType);
+    operator UnspecifiedBoolType*() const { return m_cell ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
+
+    bool operator!() const { return !m_cell; }
+
+protected:
+    JSCell* m_cell;
+};
+
+template <> class DeprecatedPtr<Unknown> {
+public:
+    DeprecatedPtr() { }
+    DeprecatedPtr(JSValue value) : m_value(value) { }
+    DeprecatedPtr(JSCell* value) : m_value(value) { }
+    const JSValue& get() const { return m_value; }
+    const JSValue* operator*() const { return &m_value; }
+    const JSValue* operator->() const { return &m_value; }
+    
+    JSValue* slot() { return &m_value; }
+    
+    typedef JSValue (DeprecatedPtr::*UnspecifiedBoolType);
+    operator UnspecifiedBoolType*() const { return m_value ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
+    bool operator!() const { return !m_value; }
+    
+private:
+    JSValue m_value;
+};
+
+template <typename T> struct WriteBarrierCheck {
+    static const bool IsJSValue = false;
+};
+
+template <> struct WriteBarrierCheck<JSValue> {
+    static const bool IsJSValue = true;
+};
+
+template <typename T> class WriteBarrierBase {
+public:
+    COMPILE_ASSERT(!WriteBarrierCheck<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
+    void set(JSGlobalData&, const JSCell*, T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+    
+    T* get() const { return reinterpret_cast<T*>(m_cell); }
+    T* operator*() const { return static_cast<T*>(m_cell); }
+    T* operator->() const { return static_cast<T*>(m_cell); }
+    void clear() { m_cell = 0; }
+    
+    JSCell** slot() { return &m_cell; }
+    
+    typedef T* (WriteBarrierBase::*UnspecifiedBoolType);
+    operator UnspecifiedBoolType*() const { return m_cell ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
+    
+    bool operator!() const { return !m_cell; }
+
+    void setWithoutWriteBarrier(T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+
+protected:
+    JSCell* m_cell;
+};
+
+template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
+public:
+    WriteBarrier() { this->m_cell = 0; }
+    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value)
+    {
+        this->set(globalData, owner, value);
+    }
+
+};
+
+template <> class WriteBarrierBase<Unknown> {
+public:
+    void set(JSGlobalData&, const JSCell*, JSValue value) { m_value = JSValue::encode(value); }
+    void setWithoutWriteBarrier(JSValue value) { m_value = JSValue::encode(value); }
+    JSValue get() const { return JSValue::decode(m_value); }
+    void clear() { m_value = JSValue::encode(JSValue()); }
+    void setUndefined() { m_value = JSValue::encode(jsUndefined()); }
+    bool isNumber() const { return get().isNumber(); }
+    bool isGetterSetter() const { return get().isGetterSetter(); }
+    
+    JSValue* slot()
+    { 
+        union {
+            EncodedJSValue* v;
+            JSValue* slot;
+        } u;
+        u.v = &m_value;
+        return u.slot;
+    }
+    
+    typedef JSValue (WriteBarrierBase::*UnspecifiedBoolType);
+    operator UnspecifiedBoolType*() const { return get() ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
+    bool operator!() const { return !get(); } 
+    
+protected:
+    EncodedJSValue m_value;
+};
+
+template <> class WriteBarrier<Unknown> : public WriteBarrierBase<Unknown> {
+public:
+    WriteBarrier() { m_value = JSValue::encode(JSValue()); }
+    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, JSValue value)
+    {
+        this->set(globalData, owner, value);
+    }
+};
+
+template <typename U, typename V> inline bool operator==(const DeprecatedPtr<U>& lhs, const DeprecatedPtr<V>& rhs)
+{
+    return lhs.get() == rhs.get();
+}
+
+template <typename U, typename V> inline bool operator==(const WriteBarrierBase<U>& lhs, const WriteBarrierBase<V>& rhs)
+{
+    return lhs.get() == rhs.get();
+}
+
+}
+
+#endif // WriteBarrier_h
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index 8d7f69c..8e27304 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -29,7 +29,7 @@ import commands
 
 from settings import *
 
-jscore_excludes = ['chartables.c', 'jsc.cpp', 'ucptable.cpp','ProfilerServer.mm', 'ExecutableAllocatorPosix.cpp']
+jscore_excludes = ['jsc.cpp', 'ProfilerServer.mm', 'ExecutableAllocatorPosix.cpp']
 jscore_excludes.extend(get_excludes(jscore_dir, ['*Brew.cpp', '*CF.cpp', '*Symbian.cpp']))
 
 sources = []
diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index 1841150..cdde180 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -54,6 +54,12 @@
 #include <wtf/Vector.h>
 #endif
 
+#if PLATFORM(MAC)
+#include <cxxabi.h>
+#include <dlfcn.h>
+#include <execinfo.h>
+#endif
+
 extern "C" {
 
 #if PLATFORM(BREWMP)
@@ -101,7 +107,8 @@ static void vprintf_stderr_common(const char* format, va_list args)
         free(buffer);
         CFRelease(str);
         CFRelease(cfFormat);
-    } else
+        return;
+    }
 #elif PLATFORM(BREWMP)
     // When str is 0, the return value is the number of bytes needed
     // to accept the result including null termination.
@@ -164,10 +171,13 @@ static void printf_stderr_common(const char* format, ...)
 
 static void printCallSite(const char* file, int line, const char* function)
 {
-#if OS(WIN) && !OS(WINCE) && defined _DEBUG
+#if OS(WINDOWS) && !OS(WINCE) && defined(_DEBUG)
     _CrtDbgReport(_CRT_WARN, file, line, NULL, "%s\n", function);
 #else
-    printf_stderr_common("(%s:%d %s)\n", file, line, function);
+    // By using this format, which matches the format used by MSVC for compiler errors, developers
+    // using Visual Studio can double-click the file/line number in the Output Window to have the
+    // editor navigate to that line of code. It seems fine for other developers, too.
+    printf_stderr_common("%s(%d) : %s\n", file, line, function);
 #endif
 }
 
@@ -197,6 +207,34 @@ void WTFReportArgumentAssertionFailure(const char* file, int line, const char* f
     printCallSite(file, line, function);
 }
 
+void WTFReportBacktrace()
+{
+#if PLATFORM(MAC) && !defined(NDEBUG)
+    static const int maxFrames = 32;
+    void* samples[maxFrames];
+    int frames = backtrace(samples, maxFrames);
+
+    for (int i = 1; i < frames; ++i) {
+        void* pointer = samples[i];
+
+        // Try to get a symbol name from the dynamic linker.
+        Dl_info info;
+        if (dladdr(pointer, &info) && info.dli_sname) {
+            const char* mangledName = info.dli_sname;
+
+            // Assume c++ & try to demangle the name.
+            char* demangledName = abi::__cxa_demangle(mangledName, 0, 0, 0);
+            if (demangledName) {
+                fprintf(stderr, " -> %s\n", demangledName);
+                free(demangledName);
+            } else
+                fprintf(stderr, " -> %s\n", mangledName);
+        } else
+            fprintf(stderr, " -> %p\n", pointer);
+    }
+#endif
+}
+
 void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...)
 {
     printf_stderr_common("FATAL ERROR: ");
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 3f3af72..13ece31 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -145,6 +145,7 @@ typedef struct {
 void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
 void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
 void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
+void WTFReportBacktrace();
 void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
 void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
 void WTFLog(WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
@@ -176,12 +177,23 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 } while(false)
 #else
 #define CRASH() do { \
+    WTFReportBacktrace(); \
     *(int *)(uintptr_t)0xbbadbeef = 0; \
     ((void(*)())0)(); /* More reliable, but doesn't say BBADBEEF */ \
 } while(false)
 #endif
 #endif
 
+/* BACKTRACE
+
+  Print a backtrace to the same location as ASSERT messages.
+*/
+#ifndef BACKTRACE
+#define BACKTRACE() do { \
+    WTFReportBacktrace(); \
+} while(false)
+#endif
+
 /* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED
 
   These macros are compiled out of release builds.
diff --git a/Source/JavaScriptCore/wtf/Bitmap.h b/Source/JavaScriptCore/wtf/Bitmap.h
index 4dd88f6..b046b61 100644
--- a/Source/JavaScriptCore/wtf/Bitmap.h
+++ b/Source/JavaScriptCore/wtf/Bitmap.h
@@ -21,8 +21,8 @@
 
 #include "FixedArray.h"
 #include "StdLibExtras.h"
-
 #include <stdint.h>
+#include <string.h>
 
 namespace WTF {
 
@@ -36,9 +36,10 @@ public:
 
     bool get(size_t) const;
     void set(size_t);
+    bool testAndSet(size_t);
+    size_t nextPossiblyUnset(size_t) const;
     void clear(size_t);
     void clearAll();
-    void advanceToNextFreeBit(size_t&) const;
     size_t count(size_t = 0) const;
     size_t isEmpty() const;
     size_t isFull() const;
@@ -76,6 +77,16 @@ inline void Bitmap<size>::set(size_t n)
 }
 
 template<size_t size>
+inline bool Bitmap<size>::testAndSet(size_t n)
+{
+    WordType mask = one << (n % wordSize);
+    size_t index = n / wordSize;
+    bool result = bits[index] & mask;
+    bits[index] |= mask;
+    return result;
+}
+
+template<size_t size>
 inline void Bitmap<size>::clear(size_t n)
 {
     bits[n / wordSize] &= ~(one << (n % wordSize));
@@ -88,12 +99,11 @@ inline void Bitmap<size>::clearAll()
 }
 
 template<size_t size>
-inline void Bitmap<size>::advanceToNextFreeBit(size_t& start) const
+inline size_t Bitmap<size>::nextPossiblyUnset(size_t start) const
 {
     if (!~bits[start / wordSize])
-        start = ((start / wordSize) + 1) * wordSize;
-    else
-        ++start;
+        return ((start / wordSize) + 1) * wordSize;
+    return start + 1;
 }
 
 template<size_t size>
diff --git a/Source/JavaScriptCore/wtf/BloomFilter.h b/Source/JavaScriptCore/wtf/BloomFilter.h
new file mode 100644
index 0000000..f81d83e
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/BloomFilter.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BloomFilter_h
+#define BloomFilter_h
+
+#include <wtf/AlwaysInline.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WTF {
+
+// Counting bloom filter with k=2 and 8 bit counters. Uses 2^keyBits bytes of memory.
+// False positive rate is approximately (1-e^(-2n/m))^2, where n is the number of unique 
+// keys and m is the table size (==2^keyBits).
+template <unsigned keyBits>
+class BloomFilter {
+public:
+    COMPILE_ASSERT(keyBits <= 16, bloom_filter_key_size);
+
+    static const size_t tableSize = 1 << keyBits;
+    static const unsigned keyMask = (1 << keyBits) - 1;
+    static uint8_t maximumCount() { return std::numeric_limits<uint8_t>::max(); }
+    
+    BloomFilter() { clear(); }
+
+    void add(unsigned hash);
+    void remove(unsigned hash);
+
+    // The filter may give false positives (claim it may contain a key it doesn't)
+    // but never false negatives (claim it doesn't contain a key it does).
+    bool mayContain(unsigned hash) const { return firstSlot(hash) && secondSlot(hash); }
+    
+    // The filter must be cleared before reuse even if all keys are removed.
+    // Otherwise overflowed keys will stick around.
+    void clear();
+
+    void add(const AtomicString& string) { add(string.impl()->existingHash()); }
+    void add(const String& string) { add(string.impl()->hash()); }
+    void remove(const AtomicString& string) { remove(string.impl()->existingHash()); }
+    void remove(const String& string) { remove(string.impl()->hash()); }
+
+    bool mayContain(const AtomicString& string) const { return mayContain(string.impl()->existingHash()); }
+    bool mayContain(const String& string) const { return mayContain(string.impl()->hash()); }
+
+#if !ASSERT_DISABLED
+    // Slow.
+    bool likelyEmpty() const;
+    bool isClear() const;
+#endif
+
+private:
+    uint8_t& firstSlot(unsigned hash) { return m_table[hash & keyMask]; }
+    uint8_t& secondSlot(unsigned hash) { return m_table[(hash >> 16) & keyMask]; }
+    const uint8_t& firstSlot(unsigned hash) const { return m_table[hash & keyMask]; }
+    const uint8_t& secondSlot(unsigned hash) const { return m_table[(hash >> 16) & keyMask]; }
+
+    uint8_t m_table[tableSize];
+};
+    
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::add(unsigned hash)
+{
+    uint8_t& first = firstSlot(hash);
+    uint8_t& second = secondSlot(hash);
+    if (LIKELY(first < maximumCount()))
+        ++first;
+    if (LIKELY(second < maximumCount()))
+        ++second;
+}
+
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::remove(unsigned hash)
+{
+    uint8_t& first = firstSlot(hash);
+    uint8_t& second = secondSlot(hash);
+    ASSERT(first);
+    ASSERT(second);
+    // In case of an overflow, the slot sticks in the table until clear().
+    if (LIKELY(first < maximumCount()))
+        --first;
+    if (LIKELY(second < maximumCount()))
+        --second;
+}
+    
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::clear()
+{
+    memset(m_table, 0, tableSize);
+}
+
+#if !ASSERT_DISABLED
+template <unsigned keyBits>
+bool BloomFilter<keyBits>::likelyEmpty() const
+{
+    for (size_t n = 0; n < tableSize; ++n) {
+        if (m_table[n] && m_table[n] != maximumCount())
+            return false;
+    }
+    return true;
+}
+
+template <unsigned keyBits>
+bool BloomFilter<keyBits>::isClear() const
+{
+    for (size_t n = 0; n < tableSize; ++n) {
+        if (m_table[n])
+            return false;
+    }
+    return true;
+}
+#endif
+
+}
+
+using WTF::BloomFilter;
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index b1931d7..f85bf02 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -9,6 +9,7 @@ SET(WTF_HEADERS
     ByteArray.h
     Complex.h
     CrossThreadRefCounted.h
+    CryptographicallyRandomNumber.h
     CurrentTime.h
     DateMath.h
     DecimalNumber.h
@@ -41,8 +42,8 @@ SET(WTF_HEADERS
     NotFound.h
     NullPtr.h
     OSAllocator.h
+    OSRandomSource.h
     OwnArrayPtr.h
-    OwnArrayPtrCommon.h
     OwnFastMallocPtr.h
     OwnPtr.h
     OwnPtrCommon.h
@@ -95,6 +96,7 @@ SET(WTF_HEADERS
     text/StringImplBase.h
     text/WTFString.h
 
+    unicode/CharacterNames.h
     unicode/Collator.h
     unicode/UTF8.h
     unicode/Unicode.h
@@ -103,12 +105,14 @@ SET(WTF_HEADERS
 SET(WTF_SOURCES
     Assertions.cpp
     ByteArray.cpp
+    CryptographicallyRandomNumber.cpp
     CurrentTime.cpp
     DecimalNumber.cpp
     FastMalloc.cpp
     HashTable.cpp
     MainThread.cpp
     MD5.cpp
+    OSRandomSource.cpp
     RandomNumber.cpp
     RefCountedLeakCounter.cpp
     StackBounds.cpp
@@ -136,6 +140,7 @@ INCLUDE_IF_EXISTS(${JAVASCRIPTCORE_DIR}/wtf/CMakeLists${PORT}.txt)
 
 LIST(APPEND WTF_INCLUDE_DIRECTORIES
     "${CMAKE_BINARY_DIR}"
+    "${CMAKE_SOURCE_DIR}/ThirdParty"
 )
 
 WEBKIT_WRAP_SOURCELIST(${WTF_SOURCES})
diff --git a/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp
new file mode 100644
index 0000000..4c49873
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 1996, David Mazieres <dm@uun.org>
+ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Arc4 random number generator for OpenBSD.
+ *
+ * This code is derived from section 17.1 of Applied Cryptography,
+ * second edition, which describes a stream cipher allegedly
+ * compatible with RSA Labs "RC4" cipher (the actual description of
+ * which is a trade secret).  The same algorithm is used as a stream
+ * cipher called "arcfour" in Tatu Ylonen's ssh package.
+ *
+ * RC4 is a registered trademark of RSA Laboratories.
+ */
+
+#include "config.h"
+#include "CryptographicallyRandomNumber.h"
+
+#include "MainThread.h"
+#include "OSRandomSource.h"
+#include "StdLibExtras.h"
+#include "ThreadingPrimitives.h"
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+
+namespace {
+
+class ARC4Stream {
+public:
+    ARC4Stream();
+
+    uint8_t i;
+    uint8_t j;
+    uint8_t s[256];
+};
+
+class ARC4RandomNumberGenerator {
+public:
+    ARC4RandomNumberGenerator();
+
+    uint32_t randomNumber();
+    void randomValues(void* buffer, size_t length);
+
+private:
+    inline void addRandomData(unsigned char *data, int length);
+    void stir();
+    void stirIfNeeded();
+    inline uint8_t getByte();
+    inline uint32_t getWord();
+
+    ARC4Stream m_stream;
+    int m_count;
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    Mutex m_mutex;
+#endif
+};
+
+ARC4Stream::ARC4Stream()
+{
+    for (int n = 0; n < 256; n++)
+        s[n] = n;
+    i = 0;
+    j = 0;
+}
+
+ARC4RandomNumberGenerator::ARC4RandomNumberGenerator()
+    : m_count(0)
+{
+}
+
+void ARC4RandomNumberGenerator::addRandomData(unsigned char* data, int length)
+{
+    m_stream.i--;
+    for (int n = 0; n < 256; n++) {
+        m_stream.i++;
+        uint8_t si = m_stream.s[m_stream.i];
+        m_stream.j += si + data[n % length];
+        m_stream.s[m_stream.i] = m_stream.s[m_stream.j];
+        m_stream.s[m_stream.j] = si;
+    }
+    m_stream.j = m_stream.i;
+}
+
+void ARC4RandomNumberGenerator::stir()
+{
+    unsigned char randomness[128];
+    size_t length = sizeof(randomness);
+    cryptographicallyRandomValuesFromOS(randomness, length);
+    addRandomData(randomness, length);
+
+    // Discard early keystream, as per recommendations in:
+    // http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
+    for (int i = 0; i < 256; i++)
+        getByte();
+    m_count = 1600000;
+}
+
+void ARC4RandomNumberGenerator::stirIfNeeded()
+{
+    if (m_count <= 0)
+        stir();
+}
+
+uint8_t ARC4RandomNumberGenerator::getByte()
+{
+    m_stream.i++;
+    uint8_t si = m_stream.s[m_stream.i];
+    m_stream.j += si;
+    uint8_t sj = m_stream.s[m_stream.j];
+    m_stream.s[m_stream.i] = sj;
+    m_stream.s[m_stream.j] = si;
+    return (m_stream.s[(si + sj) & 0xff]);
+}
+
+uint32_t ARC4RandomNumberGenerator::getWord()
+{
+    uint32_t val;
+    val = getByte() << 24;
+    val |= getByte() << 16;
+    val |= getByte() << 8;
+    val |= getByte();
+    return val;
+}
+
+uint32_t ARC4RandomNumberGenerator::randomNumber()
+{
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    MutexLocker locker(m_mutex);
+#else
+    ASSERT(isMainThread());
+#endif
+
+    m_count -= 4;
+    stirIfNeeded();
+    return getWord();
+}
+
+void ARC4RandomNumberGenerator::randomValues(void* buffer, size_t length)
+{
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    MutexLocker locker(m_mutex);
+#else
+    ASSERT(isMainThread());
+#endif
+
+    unsigned char* result = reinterpret_cast<unsigned char*>(buffer);
+    stirIfNeeded();
+    while (length--) {
+        m_count--;
+        stirIfNeeded();
+        result[length] = getByte();
+    }
+}
+
+ARC4RandomNumberGenerator& sharedRandomNumberGenerator()
+{
+    DEFINE_STATIC_LOCAL(ARC4RandomNumberGenerator, randomNumberGenerator, ());
+    return randomNumberGenerator;
+}
+
+}
+
+uint32_t cryptographicallyRandomNumber()
+{
+    return sharedRandomNumberGenerator().randomNumber();
+}
+
+void cryptographicallyRandomValues(void* buffer, size_t length)
+{
+    sharedRandomNumberGenerator().randomValues(buffer, length);
+}
+
+#endif
+
+}
diff --git a/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h
new file mode 100644
index 0000000..348242e
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_CryptographicallyRandomNumber_h
+#define WTF_CryptographicallyRandomNumber_h
+
+#include <stdint.h>
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+uint32_t cryptographicallyRandomNumber();
+void cryptographicallyRandomValues(void* buffer, size_t length);
+#endif
+
+}
+
+#if USE(OS_RANDOMNESS)
+using WTF::cryptographicallyRandomNumber;
+using WTF::cryptographicallyRandomValues;
+#endif
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/CurrentTime.h b/Source/JavaScriptCore/wtf/CurrentTime.h
index 7119656..5fcb63a 100644
--- a/Source/JavaScriptCore/wtf/CurrentTime.h
+++ b/Source/JavaScriptCore/wtf/CurrentTime.h
@@ -36,27 +36,27 @@
 
 namespace WTF {
 
-    // Returns the current UTC time in seconds, counted from January 1, 1970.
-    // Precision varies depending on platform but is usually as good or better 
-    // than a millisecond.
-    double currentTime();
+// Returns the current UTC time in seconds, counted from January 1, 1970.
+// Precision varies depending on platform but is usually as good or better
+// than a millisecond.
+double currentTime();
 
-    // Same thing, in milliseconds.
-    inline double currentTimeMS()
-    {
-        return currentTime() * 1000.0; 
-    }
+// Same thing, in milliseconds.
+inline double currentTimeMS()
+{
+    return currentTime() * 1000.0;
+}
 
-    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
-    {
-    #if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
-        *localTM = *localtime(localTime);
-    #elif COMPILER(MSVC)
-        localtime_s(localTM, localTime);
-    #else
-        localtime_r(localTime, localTM);
-    #endif
-    }
+inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+{
+#if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
+    *localTM = *localtime(localTime);
+#elif COMPILER(MSVC)
+    localtime_s(localTM, localTime);
+#else
+    localtime_r(localTime, localTM);
+#endif
+}
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/wtf/DateMath.h b/Source/JavaScriptCore/wtf/DateMath.h
index 41bd4fa..2ac284e 100644
--- a/Source/JavaScriptCore/wtf/DateMath.h
+++ b/Source/JavaScriptCore/wtf/DateMath.h
@@ -135,7 +135,6 @@ public:
         , year(0)
         , isDST(0)
         , utcOffset(0)
-        , timeZone(0)
     {
     }
 
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.cpp b/Source/JavaScriptCore/wtf/FastMalloc.cpp
index ae93c02..29e9a1a 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/Source/JavaScriptCore/wtf/FastMalloc.cpp
@@ -1061,11 +1061,8 @@ class PageHeapAllocator {
   template <class Recorder>
   void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
   {
-      vm_address_t adminAllocation = reinterpret_cast<vm_address_t>(allocated_regions_);
-      while (adminAllocation) {
-          recorder.recordRegion(adminAllocation, kAllocIncrement);
-          adminAllocation = *reader(reinterpret_cast<vm_address_t*>(adminAllocation));
-      }
+      for (void* adminAllocation = allocated_regions_; adminAllocation; adminAllocation = reader.nextEntryInLinkedList(reinterpret_cast<void**>(adminAllocation)))
+          recorder.recordRegion(reinterpret_cast<vm_address_t>(adminAllocation), kAllocIncrement);
   }
 #endif
 };
@@ -2221,7 +2218,7 @@ class TCMalloc_ThreadCache_FreeList {
   template <class Finder, class Reader>
   void enumerateFreeObjects(Finder& finder, const Reader& reader)
   {
-      for (void* nextObject = list_; nextObject; nextObject = *reader(reinterpret_cast<void**>(nextObject)))
+      for (void* nextObject = list_; nextObject; nextObject = reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
           finder.visit(nextObject);
   }
 #endif
@@ -2346,7 +2343,7 @@ class TCMalloc_Central_FreeList {
     Span* remoteSpan = nonempty_.next;
 
     for (Span* span = reader(remoteSpan); span && remoteSpan != remoteNonempty; remoteSpan = span->next, span = (span->next ? reader(span->next) : 0)) {
-      for (void* nextObject = span->objects; nextObject; nextObject = *reader(reinterpret_cast<void**>(nextObject)))
+      for (void* nextObject = span->objects; nextObject; nextObject = reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
         finder.visit(nextObject);
     }
   }
@@ -4341,12 +4338,15 @@ public:
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
+        if (!span)
+            return 1;
+
         if (span->free) {
             void* ptr = reinterpret_cast<void*>(span->start << kPageShift);
             m_freeObjectFinder.visit(ptr);
         } else if (span->sizeclass) {
             // Walk the free list of the small-object span, keeping track of each object seen
-            for (void* nextObject = span->objects; nextObject; nextObject = *m_reader(reinterpret_cast<void**>(nextObject)))
+            for (void* nextObject = span->objects; nextObject; nextObject = m_reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
                 m_freeObjectFinder.visit(nextObject);
         }
         return span->length;
@@ -4430,7 +4430,7 @@ public:
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
-        if (!span->start)
+        if (!span || !span->start)
             return 1;
 
         if (m_seenPointers.contains(ptr))
diff --git a/Source/JavaScriptCore/wtf/HashSet.h b/Source/JavaScriptCore/wtf/HashSet.h
index be6b93d..82245f3 100644
--- a/Source/JavaScriptCore/wtf/HashSet.h
+++ b/Source/JavaScriptCore/wtf/HashSet.h
@@ -175,14 +175,14 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V>
-    pair<typename HashSet<T, U, V>::iterator, bool> HashSet<T, U, V>::add(const ValueType& value)
+    inline pair<typename HashSet<T, U, V>::iterator, bool> HashSet<T, U, V>::add(const ValueType& value)
     {
         return m_impl.add(value);
     }
 
     template<typename Value, typename HashFunctions, typename Traits>
     template<typename T, typename HashTranslator>
-    pair<typename HashSet<Value, HashFunctions, Traits>::iterator, bool>
+    inline pair<typename HashSet<Value, HashFunctions, Traits>::iterator, bool>
     HashSet<Value, HashFunctions, Traits>::add(const T& value)
     {
         typedef HashSetTranslatorAdapter<ValueType, ValueTraits, T, HashTranslator> Adapter;
diff --git a/Source/JavaScriptCore/wtf/MallocZoneSupport.h b/Source/JavaScriptCore/wtf/MallocZoneSupport.h
index 62df145..4332e40 100644
--- a/Source/JavaScriptCore/wtf/MallocZoneSupport.h
+++ b/Source/JavaScriptCore/wtf/MallocZoneSupport.h
@@ -47,7 +47,6 @@ public:
     {
         void* output;
         kern_return_t err = (*m_reader)(m_task, address, size, static_cast<void**>(&output));
-        ASSERT(!err);
         if (err)
             output = 0;
         return output;
@@ -58,6 +57,15 @@ public:
     {
         return static_cast<T*>((*this)(reinterpret_cast<vm_address_t>(address), size));
     }
+
+    template <typename T>
+    T* nextEntryInLinkedList(T** address) const
+    {
+        T** output = (*this)(address);
+        if (!output)
+            return 0;
+        return *output;
+    }
 };
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/MathExtras.h b/Source/JavaScriptCore/wtf/MathExtras.h
index 095549e..ec27f5f 100644
--- a/Source/JavaScriptCore/wtf/MathExtras.h
+++ b/Source/JavaScriptCore/wtf/MathExtras.h
@@ -26,8 +26,10 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
+#include <algorithm>
 #include <cmath>
 #include <float.h>
+#include <limits>
 #include <stdlib.h>
 
 #if OS(SOLARIS)
@@ -205,6 +207,32 @@ inline float deg2turn(float d) { return d / 360.0f; }
 inline float rad2grad(float r) { return r * 200.0f / piFloat; }
 inline float grad2rad(float g) { return g * piFloat / 200.0f; }
 
+inline int clampToInteger(double d)
+{
+    const double minIntAsDouble = std::numeric_limits<int>::min();
+    const double maxIntAsDouble = std::numeric_limits<int>::max();
+    return static_cast<int>(std::max(std::min(d, maxIntAsDouble), minIntAsDouble));
+}
+
+inline int clampToPositiveInteger(double d)
+{
+    const double maxIntAsDouble = std::numeric_limits<int>::max();
+    return static_cast<int>(std::max<double>(std::min(d, maxIntAsDouble), 0));
+}
+
+inline int clampToInteger(float d)
+{
+    const float minIntAsFloat = static_cast<float>(std::numeric_limits<int>::min());
+    const float maxIntAsFloat = static_cast<float>(std::numeric_limits<int>::max());
+    return static_cast<int>(std::max(std::min(d, maxIntAsFloat), minIntAsFloat));
+}
+
+inline int clampToPositiveInteger(float d)
+{
+    const float maxIntAsFloat = static_cast<float>(std::numeric_limits<int>::max());
+    return static_cast<int>(std::max<float>(std::min(d, maxIntAsFloat), 0));
+}
+
 #if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP)))
 using std::isfinite;
 using std::isinf;
diff --git a/Source/JavaScriptCore/wtf/OSRandomSource.cpp b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
new file mode 100644
index 0000000..0c1416a
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OSRandomSource.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#if OS(UNIX)
+#include <fcntl.h>
+#include <unistd.h>
+#endif
+
+#if OS(WINDOWS)
+#include <windows.h>
+#include <wincrypt.h> // windows.h must be included before wincrypt.h.
+#endif
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+void cryptographicallyRandomValuesFromOS(unsigned char* buffer, size_t length)
+{
+#if OS(UNIX)
+    int fd = open("/dev/urandom", O_RDONLY, 0);
+    if (fd < 0)
+        CRASH(); // We need /dev/urandom for this API to work...
+
+    if (read(fd, buffer, length) != static_cast<ssize_t>(length))
+        CRASH();
+
+    close(fd);
+#elif OS(WINDOWS)
+    HCRYPTPROV hCryptProv = 0;
+    if (!CryptAcquireContext(&hCryptProv, 0, MS_DEF_PROV, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+        CRASH();
+    if (!CryptGenRandom(hCryptProv, length, buffer))
+        CRASH();
+    CryptReleaseContext(hCryptProv, 0);
+#else
+    #error "This configuration doesn't have a strong source of randomness."
+    // WARNING: When adding new sources of OS randomness, the randomness must
+    //          be of cryptographic quality!
+#endif
+}
+#endif
+
+}
diff --git a/Source/JavaScriptCore/wtf/OSRandomSource.h b/Source/JavaScriptCore/wtf/OSRandomSource.h
new file mode 100644
index 0000000..214a954
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/OSRandomSource.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_OSRandomSource_h
+#define WTF_OSRandomSource_h
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+// This function attempts to fill buffer with randomness from the operating
+// system.  If insufficient randomness is available, the buffer will be
+// partially filled.  Rather than calling this function directly, consider
+// calling cryptographicallyRandomNumber or cryptographicallyRandomValues.
+void cryptographicallyRandomValuesFromOS(unsigned char* buffer, size_t length);
+#endif
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtr.h b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
index f838a7e..6b7c8da 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -24,13 +24,9 @@
 #include "Assertions.h"
 #include "Noncopyable.h"
 #include "NullPtr.h"
-#include "OwnPtrCommon.h"
-#include "OwnArrayPtrCommon.h"
+#include "PassOwnArrayPtr.h"
 #include <algorithm>
 
-// Remove this once we make all WebKit code compatible with stricter rules about OwnArrayPtr.
-#define LOOSE_OWN_ARRAY_PTR
-
 namespace WTF {
 
 template<typename T> class PassOwnArrayPtr;
@@ -115,16 +111,6 @@ template<typename T> inline typename OwnArrayPtr<T>::PtrType OwnArrayPtr<T>::lea
     return ptr;
 }
 
-#ifdef LOOSE_OWN_ARRAY_PTR
-template<typename T> inline void OwnArrayPtr<T>::set(PtrType ptr)
-{
-    ASSERT(!ptr || m_ptr != ptr);
-    PtrType oldPtr = m_ptr;
-    m_ptr = ptr;
-    deleteOwnedPtr(oldPtr);
-}
-#endif
-
 template<typename T> inline OwnArrayPtr<T>& OwnArrayPtr<T>::operator=(const PassOwnArrayPtr<T>& o)
 {
     PtrType ptr = m_ptr;
diff --git a/Source/JavaScriptCore/wtf/PageAllocation.h b/Source/JavaScriptCore/wtf/PageAllocation.h
index 232cd20..ad3d217 100644
--- a/Source/JavaScriptCore/wtf/PageAllocation.h
+++ b/Source/JavaScriptCore/wtf/PageAllocation.h
@@ -85,10 +85,17 @@ public:
     {
     }
 
-    using PageBlock::operator bool;
     using PageBlock::size;
     using PageBlock::base;
 
+#ifndef __clang__
+    using PageBlock::operator bool;
+#else
+    // FIXME: This is a workaround for <rdar://problem/8876150>, wherein Clang incorrectly emits an access
+    // control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+    operator bool() const { return PageBlock::operator bool(); }
+#endif
+
     static PageAllocation allocate(size_t size, OSAllocator::Usage usage = OSAllocator::UnknownUsage, bool writable = true, bool executable = false)
     {
         ASSERT(isPageAligned(size));
diff --git a/Source/JavaScriptCore/wtf/PageReservation.h b/Source/JavaScriptCore/wtf/PageReservation.h
index 8c097a4..6dff700 100644
--- a/Source/JavaScriptCore/wtf/PageReservation.h
+++ b/Source/JavaScriptCore/wtf/PageReservation.h
@@ -57,18 +57,23 @@ namespace WTF {
 class PageReservation : private PageBlock {
 public:
     PageReservation()
-        : m_writable(false)
+        : m_committed(0)
+        , m_writable(false)
         , m_executable(false)
-#ifndef NDEBUG
-        , m_committed(0)
-#endif
     {
     }
-    
-    using PageBlock::operator bool;
+
     using PageBlock::base;
     using PageBlock::size;
 
+#ifndef __clang__
+    using PageBlock::operator bool;
+#else
+    // FIXME: This is a workaround for <rdar://problem/8876150>, wherein Clang incorrectly emits an access
+    // control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+    operator bool() const { return PageBlock::operator bool(); }
+#endif
+
     void commit(void* start, size_t size)
     {
         ASSERT(*this);
@@ -76,9 +81,7 @@ public:
         ASSERT(isPageAligned(size));
         ASSERT(contains(start, size));
 
-#ifndef NDEBUG
         m_committed += size;
-#endif
         OSAllocator::commit(start, size, m_writable, m_executable);
     }
 
@@ -89,12 +92,15 @@ public:
         ASSERT(isPageAligned(size));
         ASSERT(contains(start, size));
 
-#ifndef NDEBUG
         m_committed -= size;
-#endif
         OSAllocator::decommit(start, size);
     }
 
+    size_t committed()
+    {
+        return m_committed;
+    }
+
     static PageReservation reserve(size_t size, OSAllocator::Usage usage = OSAllocator::UnknownUsage, bool writable = true, bool executable = false)
     {
         ASSERT(isPageAligned(size));
@@ -119,19 +125,15 @@ public:
 private:
     PageReservation(void* base, size_t size, bool writable, bool executable)
         : PageBlock(base, size)
+        , m_committed(0)
         , m_writable(writable)
         , m_executable(executable)
-#ifndef NDEBUG
-        , m_committed(0)
-#endif
     {
     }
 
+    size_t m_committed;
     bool m_writable;
     bool m_executable;
-#ifndef NDEBUG
-    size_t m_committed;
-#endif
 };
 
 }
diff --git a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
index 499e850..e1aa61e 100644
--- a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
@@ -28,7 +28,6 @@
 
 #include "Assertions.h"
 #include "NullPtr.h"
-#include "OwnArrayPtrCommon.h"
 #include "TypeTraits.h"
 
 // Remove this once we make all WebKit code compatible with stricter rules about PassOwnArrayPtr.
@@ -39,6 +38,7 @@ namespace WTF {
 template<typename T> class OwnArrayPtr;
 template<typename T> class PassOwnArrayPtr;
 template<typename T> PassOwnArrayPtr<T> adoptArrayPtr(T*);
+template<typename T> void deleteOwnedArrayPtr(T* ptr);
 
 template<typename T> class PassOwnArrayPtr {
 public:
@@ -194,6 +194,13 @@ template<typename T> inline PassOwnArrayPtr<T> adoptArrayPtr(T* ptr)
     return PassOwnArrayPtr<T>(ptr);
 }
 
+template<typename T> inline void deleteOwnedArrayPtr(T* ptr)
+{
+    typedef char known[sizeof(T) ? 1 : -1];
+    if (sizeof(known))
+        delete [] ptr;
+}
+
 template<typename T, typename U> inline PassOwnArrayPtr<T> static_pointer_cast(const PassOwnArrayPtr<U>& p) 
 {
     return adoptArrayPtr(static_cast<T*>(p.leakPtr()));
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index e3fec74..18f481d 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -564,6 +564,7 @@
 
 #if OS(WINCE)
 #include <ce_time.h>
+#define WTF_USE_MERSENNE_TWISTER_19937 1
 #endif
 
 #if (PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
@@ -600,22 +601,28 @@
 #endif
 
 #if PLATFORM(MAC) && !PLATFORM(IOS)
-#define WTF_PLATFORM_CF 1
-#define WTF_USE_PTHREADS 1
-#define HAVE_PTHREAD_RWLOCK 1
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#define ENABLE_GESTURE_EVENTS 1
+#define ENABLE_RUBBER_BANDING 1
+#define WTF_USE_WK_SCROLLBAR_PAINTER 1
+#endif
 #if !defined(ENABLE_JAVA_BRIDGE)
 #define ENABLE_JAVA_BRIDGE 1
 #endif
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 1
 #endif
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #define HAVE_READLINE 1
 #define HAVE_RUNLOOP_TIMER 1
 #define ENABLE_FULLSCREEN_API 1
 #define ENABLE_SMOOTH_SCROLLING 1
+#define ENABLE_WEB_ARCHIVE 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IOS) */
 
 #if PLATFORM(ANDROID)
@@ -660,6 +667,7 @@
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
+#define ENABLE_WEB_ARCHIVE 1
 #endif
 
 #if PLATFORM(ANDROID)
@@ -683,6 +691,10 @@
 #define WTF_USE_PTHREADS 0
 #endif
 
+#if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(CHROMIUM) && !PLATFORM(QT)
+#define ENABLE_WEB_ARCHIVE 1
+#endif
+
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
@@ -690,6 +702,7 @@
 #define WTF_PLATFORM_CF 1
 #ifndef BUILDING_ON_TIGER
 #define WTF_USE_CORE_TEXT 1
+#define ENABLE_WEB_ARCHIVE 1
 #else
 #define WTF_USE_ATSUI 1
 #endif
@@ -730,6 +743,12 @@
 #define HAVE_SIGNAL_H 1
 #endif
 
+#if !defined(HAVE_STRNSTR)
+#if OS(DARWIN) || OS(FREEBSD)
+#define HAVE_STRNSTR 1
+#endif
+#endif
+
 #if !OS(WINDOWS) && !OS(SOLARIS) && !OS(QNX) \
     && !OS(SYMBIAN) && !OS(HAIKU) && !OS(RVCT) \
     && !OS(ANDROID) && !PLATFORM(BREWMP)
@@ -836,6 +855,9 @@
 #if PLATFORM(QT)
 /* We must not customize the global operator new and delete for the Qt port. */
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#if !OS(UNIX) || OS(SYMBIAN)
+#define USE_SYSTEM_MALLOC 1
+#endif
 #endif
 
 /* fastMalloc match validation allows for runtime verification that
@@ -1040,7 +1062,10 @@
 #define ENABLE_REGEXP_TRACING 0
 
 /* Yet Another Regex Runtime - turned on by default for JIT enabled ports. */
-#if ENABLE(JIT) && !defined(ENABLE_YARR_JIT)
+#if PLATFORM(CHROMIUM)
+#define ENABLE_YARR_JIT 0
+
+#elif ENABLE(JIT) && !defined(ENABLE_YARR_JIT)
 #define ENABLE_YARR_JIT 1
 
 /* Setting this flag compares JIT results with interpreter results. */
@@ -1054,8 +1079,6 @@
    security but currectly comes at a significant performance cost. */
 #if PLATFORM(IOS)
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 1
-#else
-#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 #endif
 
 /* Pick which allocator to use; we only need an executable allocator if the assembler is compiled in.
@@ -1076,6 +1099,10 @@
 #define ENABLE_SMOOTH_SCROLLING 0
 #endif
 
+#if !defined(ENABLE_WEB_ARCHIVE)
+#define ENABLE_WEB_ARCHIVE 0
+#endif
+
 /* Use the QXmlStreamReader implementation for XMLDocumentParser */
 /* Use the QXmlQuery implementation for XSLTProcessor */
 #if PLATFORM(QT)
diff --git a/Source/JavaScriptCore/wtf/RandomNumber.cpp b/Source/JavaScriptCore/wtf/RandomNumber.cpp
index 0c45416..1574324 100644
--- a/Source/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/Source/JavaScriptCore/wtf/RandomNumber.cpp
@@ -34,9 +34,9 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#if OS(WINCE)
+#if USE(MERSENNE_TWISTER_19937)
 extern "C" {
-#include "wince/mt19937ar.c"
+#include "mt19937ar.c"
 }
 #endif
 
@@ -78,7 +78,7 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif OS(WINCE)
+#elif USE(MERSENNE_TWISTER_19937)
     return genrand_res53();
 #elif OS(WINDOWS)
     uint32_t part1 = rand() & (RAND_MAX - 1);
diff --git a/Source/JavaScriptCore/wtf/RandomNumberSeed.h b/Source/JavaScriptCore/wtf/RandomNumberSeed.h
index 9ea7c71..0703abf 100644
--- a/Source/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/Source/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -38,7 +38,7 @@
 #include <unistd.h>
 #endif
 
-#if OS(WINCE)
+#if USE(MERSENNE_TWISTER_19937)
 extern "C" {
 void init_by_array(unsigned long init_key[],int key_length);
 }
@@ -54,14 +54,6 @@ inline void initializeRandomNumberGenerator()
 #elif OS(WINCE)
     // initialize rand()
     srand(GetTickCount());
-
-    // use rand() to initialize the real RNG
-    unsigned long initializationBuffer[4];
-    initializationBuffer[0] = (rand() << 16) | rand();
-    initializationBuffer[1] = (rand() << 16) | rand();
-    initializationBuffer[2] = (rand() << 16) | rand();
-    initializationBuffer[3] = (rand() << 16) | rand();
-    init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
 #elif PLATFORM(BREWMP)
@@ -74,6 +66,16 @@ inline void initializeRandomNumberGenerator()
 #else
     srand(static_cast<unsigned>(time(0)));
 #endif
+
+#if USE(MERSENNE_TWISTER_19937)
+    // use rand() to initialize the Mersenne Twister random number generator.
+    unsigned long initializationBuffer[4];
+    initializationBuffer[0] = (rand() << 16) | rand();
+    initializationBuffer[1] = (rand() << 16) | rand();
+    initializationBuffer[2] = (rand() << 16) | rand();
+    initializationBuffer[3] = (rand() << 16) | rand();
+    init_by_array(initializationBuffer, 4);
+#endif
 }
 
 }
diff --git a/Source/JavaScriptCore/wtf/StringExtras.h b/Source/JavaScriptCore/wtf/StringExtras.h
index 473bb22..371e33b 100644
--- a/Source/JavaScriptCore/wtf/StringExtras.h
+++ b/Source/JavaScriptCore/wtf/StringExtras.h
@@ -100,8 +100,7 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if COMPILER(MSVC) || COMPILER(RVCT) || OS(WINDOWS) || OS(LINUX) || OS(SOLARIS)
-// FIXME: should check HAVE_STRNSTR
+#if !HAVE(STRNSTR)
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
diff --git a/Source/JavaScriptCore/wtf/StringHasher.h b/Source/JavaScriptCore/wtf/StringHasher.h
index 63ce74f..a84b2c4 100644
--- a/Source/JavaScriptCore/wtf/StringHasher.h
+++ b/Source/JavaScriptCore/wtf/StringHasher.h
@@ -141,6 +141,12 @@ public:
         return createHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
     }
 
+    static inline unsigned createBlobHash(const void* data, unsigned size)
+    {
+        ASSERT(!(size % 2));
+        return createHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
+    }
+
 private:
     static inline UChar defaultCoverter(UChar ch)
     {
diff --git a/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp b/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 0b7ecc9..3cb59e8 100644
--- a/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -31,6 +31,7 @@
 // Author: Sanjay Ghemawat
 
 #include "config.h"
+#if !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC)
 #include "TCSystemAlloc.h"
 
 #include <algorithm>
@@ -519,3 +520,6 @@ void TCMalloc_SystemCommit(void* start, size_t length)
 // declared in TCSystemAlloc.h
 
 #endif
+
+#endif // #if !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC)
+
diff --git a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
index 809c3e2..831a99e 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
+++ b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
@@ -150,10 +150,20 @@ private:
     PlatformCondition m_condition;
 };
 
+#if OS(WINDOWS)
+// The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the same time zone as WTF::currentTime().
+// Returns an interval in milliseconds suitable for passing to one of the Win32 wait functions (e.g., ::WaitForSingleObject).
+DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime);
+#endif
+
 } // namespace WTF
 
 using WTF::Mutex;
 using WTF::MutexLocker;
 using WTF::ThreadCondition;
 
+#if OS(WINDOWS)
+using WTF::absoluteTimeToWaitTimeoutInterval;
+#endif
+
 #endif // ThreadingPrimitives_h
diff --git a/Source/JavaScriptCore/wtf/ThreadingWin.cpp b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
index 00319a4..4ca290f 100644
--- a/Source/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -458,20 +458,15 @@ void ThreadCondition::wait(Mutex& mutex)
 
 bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    double currentTime = WTF::currentTime();
+    DWORD interval = absoluteTimeToWaitTimeoutInterval(absoluteTime);
 
-    // Time is in the past - return immediately.
-    if (absoluteTime < currentTime)
+    if (!interval) {
+        // Consider the wait to have timed out, even if our condition has already been signaled, to
+        // match the pthreads implementation.
         return false;
-
-    // Time is too far in the future (and would overflow unsigned long) - wait forever.
-    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
-        wait(mutex);
-        return true;
     }
 
-    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
-    return m_condition.timedWait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
+    return m_condition.timedWait(mutex.impl(), interval);
 }
 
 void ThreadCondition::signal()
@@ -484,4 +479,19 @@ void ThreadCondition::broadcast()
     m_condition.signal(true); // Unblock all threads.
 }
 
+DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime)
+{
+    double currentTime = WTF::currentTime();
+
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return 0;
+
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0)
+        return INFINITE;
+
+    return static_cast<DWORD>((absoluteTime - currentTime) * 1000.0);
+}
+
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index f9f8f2f..8061e8a 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -53,8 +53,8 @@ typedef struct _GHashTable GHashTable;
 typedef struct _GInputStream GInputStream;
 typedef struct _GList GList;
 typedef struct _GMutex GMutex;
-typedef struct _GOutputStream GOutputStream;
 typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GPollableOutputStream GPollableOutputStream;
 typedef struct _GSocketClient GSocketClient;
 typedef struct _GSocketConnection GSocketConnection;
 typedef struct _GSource GSource;
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.cpp b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
index dd8d66c..e0a866d 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.cpp
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
@@ -376,7 +376,20 @@ AtomicString AtomicString::fromUTF8(const char* characters)
 {
     if (!characters)
         return AtomicString();
-    return fromUTF8(characters, strlen(characters));
+
+    if (!*characters)
+        return emptyAtom;
+
+    HashAndUTF8Characters buffer;
+    buffer.characters = characters;
+    buffer.hash = calculateStringHashAndLengthFromUTF8(characters, buffer.length, buffer.utf16Length);
+
+    if (!buffer.hash)
+        return AtomicString();
+
+    AtomicString atomicString;
+    atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
+    return atomicString;
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.h b/Source/JavaScriptCore/wtf/text/StringImpl.h
index dc1dbb2..25411e1 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -354,6 +354,16 @@ inline bool equalIgnoringCase(const char* a, const UChar* b, unsigned length) {
 
 bool equalIgnoringNullity(StringImpl*, StringImpl*);
 
+template<size_t inlineCapacity>
+bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, StringImpl* b)
+{
+    if (!b)
+        return !a.size();
+    if (a.size() != b->length())
+        return false;
+    return !memcmp(a.data(), b->characters(), b->length());
+}
+
 int codePointCompare(const StringImpl*, const StringImpl*);
 
 static inline bool isSpaceOrNewline(UChar c)
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.cpp b/Source/JavaScriptCore/wtf/text/WTFString.cpp
index 4b6ff75..b9b4e74 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/Source/JavaScriptCore/wtf/text/WTFString.cpp
@@ -637,7 +637,7 @@ void String::split(UChar separator, Vector<String>& result) const
 
 CString String::ascii() const
 {
-    // Basic Latin1 (ISO) encoding - Unicode characters 0..255 are
+    // Printable ASCII characters 32..127 and the null character are
     // preserved, characters outside of this range are converted to '?'.
 
     unsigned length = this->length();
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index 4d853d2..0aee2ef 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -66,6 +66,7 @@ struct StringHash;
 // Declarations of string operations
 
 bool charactersAreAllASCII(const UChar*, size_t);
+bool charactersAreAllLatin1(const UChar*, size_t);
 int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 int64_t charactersToInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
@@ -328,6 +329,7 @@ public:
     WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
 
     bool containsOnlyASCII() const { return charactersAreAllASCII(characters(), length()); }
+    bool containsOnlyLatin1() const { return charactersAreAllLatin1(characters(), length()); }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     String(WTF::HashTableDeletedValueType) : m_impl(WTF::HashTableDeletedValue) { }
@@ -367,6 +369,9 @@ inline bool equalPossiblyIgnoringCase(const String& a, const String& b, bool ign
 
 inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
 
+template<size_t inlineCapacity>
+inline bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, const String& b) { return equalIgnoringNullity(a, b.impl()); }
+
 inline bool operator!(const String& str) { return str.isNull(); }
 
 inline void swap(String& a, String& b) { a.swap(b); }
@@ -388,6 +393,14 @@ inline bool charactersAreAllASCII(const UChar* characters, size_t length)
     return !(ored & 0xFF80);
 }
 
+inline bool charactersAreAllLatin1(const UChar* characters, size_t length)
+{
+    UChar ored = 0;
+    for (size_t i = 0; i < length; ++i)
+        ored |= characters[i];
+    return !(ored & 0xFF00);
+}
+
 int codePointCompare(const String&, const String&);
 
 inline size_t find(const UChar* characters, unsigned length, UChar matchCharacter, unsigned index = 0)
@@ -480,6 +493,7 @@ using WTF::String;
 using WTF::append;
 using WTF::appendNumber;
 using WTF::charactersAreAllASCII;
+using WTF::charactersAreAllLatin1;
 using WTF::charactersToIntStrict;
 using WTF::charactersToUIntStrict;
 using WTF::charactersToInt64Strict;
diff --git a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
new file mode 100644
index 0000000..3d093a6
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CharacterNames_h
+#define CharacterNames_h
+
+#include "Unicode.h"
+
+namespace WTF {
+namespace Unicode {
+
+// Names here are taken from the Unicode standard.
+
+// Most of these are UChar constants, not UChar32, which makes them
+// more convenient for WebCore code that mostly uses UTF-16.
+
+const UChar32 aegeanWordSeparatorLine = 0x10100;
+const UChar32 aegeanWordSeparatorDot = 0x10101;
+const UChar blackCircle = 0x25CF;
+const UChar blackSquare = 0x25A0;
+const UChar blackUpPointingTriangle = 0x25B2;
+const UChar bullet = 0x2022;
+const UChar bullseye = 0x25CE;
+const UChar carriageReturn = 0x000D;
+const UChar ethiopicPrefaceColon = 0x1366;
+const UChar ethiopicWordspace = 0x1361;
+const UChar fisheye = 0x25C9;
+const UChar hebrewPunctuationGeresh = 0x05F3;
+const UChar hebrewPunctuationGershayim = 0x05F4;
+const UChar horizontalEllipsis = 0x2026;
+const UChar hyphen = 0x2010;
+const UChar hyphenMinus = 0x002D;
+const UChar ideographicComma = 0x3001;
+const UChar ideographicFullStop = 0x3002;
+const UChar ideographicSpace = 0x3000;
+const UChar leftDoubleQuotationMark = 0x201C;
+const UChar leftSingleQuotationMark = 0x2018;
+const UChar leftToRightEmbed = 0x202A;
+const UChar leftToRightMark = 0x200E;
+const UChar leftToRightOverride = 0x202D;
+const UChar minusSign = 0x2212;
+const UChar newlineCharacter = 0x000A;
+const UChar noBreakSpace = 0x00A0;
+const UChar objectReplacementCharacter = 0xFFFC;
+const UChar popDirectionalFormatting = 0x202C;
+const UChar replacementCharacter = 0xFFFD;
+const UChar rightDoubleQuotationMark = 0x201D;
+const UChar rightSingleQuotationMark = 0x2019;
+const UChar rightToLeftEmbed = 0x202B;
+const UChar rightToLeftMark = 0x200F;
+const UChar rightToLeftOverride = 0x202E;
+const UChar sesameDot = 0xFE45;
+const UChar softHyphen = 0x00AD;
+const UChar space = 0x0020;
+const UChar tibetanMarkIntersyllabicTsheg = 0x0F0B;
+const UChar tibetanMarkDelimiterTshegBstar = 0x0F0C;
+const UChar32 ugariticWordDivider = 0x1039F;
+const UChar whiteBullet = 0x25E6;
+const UChar whiteCircle = 0x25CB;
+const UChar whiteSesameDot = 0xFE46;
+const UChar whiteUpPointingTriangle = 0x25B3;
+const UChar yenSign = 0x00A5;
+const UChar zeroWidthJoiner = 0x200D;
+const UChar zeroWidthNonJoiner = 0x200C;
+const UChar zeroWidthSpace = 0x200B;
+
+} // namespace Unicode
+} // namespace WTF
+
+using WTF::Unicode::aegeanWordSeparatorLine;
+using WTF::Unicode::aegeanWordSeparatorDot;
+using WTF::Unicode::blackCircle;
+using WTF::Unicode::blackSquare;
+using WTF::Unicode::blackUpPointingTriangle;
+using WTF::Unicode::bullet;
+using WTF::Unicode::bullseye;
+using WTF::Unicode::carriageReturn;
+using WTF::Unicode::ethiopicPrefaceColon;
+using WTF::Unicode::ethiopicWordspace;
+using WTF::Unicode::fisheye;
+using WTF::Unicode::hebrewPunctuationGeresh;
+using WTF::Unicode::hebrewPunctuationGershayim;
+using WTF::Unicode::horizontalEllipsis;
+using WTF::Unicode::hyphen;
+using WTF::Unicode::hyphenMinus;
+using WTF::Unicode::ideographicComma;
+using WTF::Unicode::ideographicFullStop;
+using WTF::Unicode::ideographicSpace;
+using WTF::Unicode::leftDoubleQuotationMark;
+using WTF::Unicode::leftSingleQuotationMark;
+using WTF::Unicode::leftToRightEmbed;
+using WTF::Unicode::leftToRightMark;
+using WTF::Unicode::leftToRightOverride;
+using WTF::Unicode::minusSign;
+using WTF::Unicode::newlineCharacter;
+using WTF::Unicode::noBreakSpace;
+using WTF::Unicode::objectReplacementCharacter;
+using WTF::Unicode::popDirectionalFormatting;
+using WTF::Unicode::replacementCharacter;
+using WTF::Unicode::rightDoubleQuotationMark;
+using WTF::Unicode::rightSingleQuotationMark;
+using WTF::Unicode::rightToLeftEmbed;
+using WTF::Unicode::rightToLeftMark;
+using WTF::Unicode::rightToLeftOverride;
+using WTF::Unicode::sesameDot;
+using WTF::Unicode::softHyphen;
+using WTF::Unicode::space;
+using WTF::Unicode::tibetanMarkIntersyllabicTsheg;
+using WTF::Unicode::tibetanMarkDelimiterTshegBstar;
+using WTF::Unicode::ugariticWordDivider;
+using WTF::Unicode::whiteBullet;
+using WTF::Unicode::whiteCircle;
+using WTF::Unicode::whiteSesameDot;
+using WTF::Unicode::whiteUpPointingTriangle;
+using WTF::Unicode::yenSign;
+using WTF::Unicode::zeroWidthJoiner;
+using WTF::Unicode::zeroWidthNonJoiner;
+using WTF::Unicode::zeroWidthSpace;
+
+#endif // CharacterNames_h
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
index dc24ed5..4c3738b 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -26,16 +26,14 @@
 
 #include "config.h"
 #include "UTF8.h"
-#include <wtf/StringHasher.h>
 
 #include "ASCIICType.h"
+#include <wtf/StringHasher.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WTF {
 namespace Unicode {
 
-// FIXME: Use definition from CharacterNames.h.
-static const UChar replacementCharacter = 0xFFFD;
-
 inline int inlineUTF8SequenceLengthNonASCII(char b0)
 {
     if ((b0 & 0xC0) != 0xC0)
@@ -316,25 +314,33 @@ ConversionResult convertUTF8ToUTF16(
     return result;
 }
 
-unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
+static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
 {
     if (!data)
         return 0;
 
     WTF::StringHasher stringHasher;
+    dataLength = 0;
     utf16Length = 0;
 
-    while (data < dataEnd) {
+    while (data < dataEnd || (!dataEnd && *data)) {
         if (isASCII(*data)) {
             stringHasher.addCharacter(*data++);
+            dataLength++;
             utf16Length++;
             continue;
         }
 
         int utf8SequenceLength = inlineUTF8SequenceLengthNonASCII(*data);
+        dataLength += utf8SequenceLength;
 
-        if (dataEnd - data < utf8SequenceLength)
-            return false;
+        if (!dataEnd) {
+            for (int i = 1; i < utf8SequenceLength; ++i) {
+                if (!data[i])
+                    return 0;
+            }
+        } else if (dataEnd - data < utf8SequenceLength)
+            return 0;
 
         if (!isLegalUTF8(reinterpret_cast<const unsigned char*>(data), utf8SequenceLength))
             return 0;
@@ -359,6 +365,17 @@ unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsi
     return stringHasher.hash();
 }
 
+unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
+{
+    unsigned dataLength;
+    return calculateStringHashAndLengthFromUTF8Internal(data, dataEnd, dataLength, utf16Length);
+}
+
+unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length)
+{
+    return calculateStringHashAndLengthFromUTF8Internal(data, 0, dataLength, utf16Length);
+}
+
 bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd)
 {
     while (b < bEnd) {
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.h b/Source/JavaScriptCore/wtf/unicode/UTF8.h
index 1f4baca..bbfaa84 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.h
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.h
@@ -71,6 +71,7 @@ namespace Unicode {
                     char** targetStart, char* targetEnd, bool strict = true);
 
     unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length);
+    unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length);
 
     bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
 
diff --git a/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h b/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
index 8959912..09a7036 100644
--- a/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
+++ b/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
@@ -1,25 +1,5 @@
 /*
  *  Copyright (C) 1999-2004, International Business Machines Corporation and others.  All Rights Reserved.
- *  Copyright (C) 2006 George Staikos <staikos@kde.org>
- *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
- *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
- *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
- *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
  *
  */
 
@@ -97,4 +77,24 @@
 
 #define U_MASK(x) ((uint32_t)1<<(x))
 
+#define U8_MAX_LENGTH 4
+
+#define U8_APPEND_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else { \
+        if((uint32_t)(c)<=0x7ff) { \
+            (s)[(i)++]=(uint8_t)(((c)>>6)|0xc0); \
+        } else { \
+            if((uint32_t)(c)<=0xffff) { \
+                (s)[(i)++]=(uint8_t)(((c)>>12)|0xe0); \
+            } else { \
+                (s)[(i)++]=(uint8_t)(((c)>>18)|0xf0); \
+                (s)[(i)++]=(uint8_t)((((c)>>12)&0x3f)|0x80); \
+            } \
+            (s)[(i)++]=(uint8_t)((((c)>>6)&0x3f)|0x80); \
+        } \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } \
+}
 #endif
diff --git a/Source/JavaScriptCore/wtf/wince/mt19937ar.c b/Source/JavaScriptCore/wtf/wince/mt19937ar.c
deleted file mode 100644
index 4715958..0000000
--- a/Source/JavaScriptCore/wtf/wince/mt19937ar.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/*
-   A C-program for MT19937, with initialization improved 2002/1/26.
-   Coded by Takuji Nishimura and Makoto Matsumoto.
-
-   Before using, initialize the state by using init_genrand(seed)
-   or init_by_array(init_key, key_length).
-
-   Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,
-   All rights reserved.
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-
-     1. Redistributions of source code must retain the above copyright
-        notice, this list of conditions and the following disclaimer.
-
-     2. Redistributions in binary form must reproduce the above copyright
-        notice, this list of conditions and the following disclaimer in the
-        documentation and/or other materials provided with the distribution.
-
-     3. The names of its contributors may not be used to endorse or promote
-        products derived from this software without specific prior written
-        permission.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
-   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-   EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-   PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-   Any feedback is very welcome.
-   http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html
-   email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space)
-*/
-
-#include <stdio.h>
-
-/* Period parameters */
-#define N 624
-#define M 397
-#define MATRIX_A 0x9908b0dfUL   /* constant vector a */
-#define UPPER_MASK 0x80000000UL /* most significant w-r bits */
-#define LOWER_MASK 0x7fffffffUL /* least significant r bits */
-
-static unsigned long mt[N]; /* the array for the state vector  */
-static int mti=N+1; /* mti==N+1 means mt[N] is not initialized */
-
-/* initializes mt[N] with a seed */
-void init_genrand(unsigned long s)
-{
-    mt[0]= s & 0xffffffffUL;
-    for (mti=1; mti<N; mti++) {
-        mt[mti] = (1812433253UL * (mt[mti-1] ^ (mt[mti-1] >> 30)) + mti);
-        /* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier. */
-        /* In the previous versions, MSBs of the seed affect   */
-        /* only MSBs of the array mt[].                        */
-        /* 2002/01/09 modified by Makoto Matsumoto             */
-        mt[mti] &= 0xffffffffUL;
-        /* for >32 bit machines */
-    }
-}
-
-/* initialize by an array with array-length */
-/* init_key is the array for initializing keys */
-/* key_length is its length */
-/* slight change for C++, 2004/2/26 */
-void init_by_array(unsigned long init_key[],int key_length)
-{
-    int i, j, k;
-    init_genrand(19650218UL);
-    i=1; j=0;
-    k = (N>key_length ? N : key_length);
-    for (; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1664525UL))
-          + init_key[j] + j; /* non linear */
-        mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
-        i++; j++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-        if (j>=key_length) j=0;
-    }
-    for (k=N-1; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1566083941UL))
-          - i; /* non linear */
-        mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
-        i++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-    }
-
-    mt[0] = 0x80000000UL; /* MSB is 1; assuring non-zero initial array */
-}
-
-/* generates a random number on [0,0xffffffff]-interval */
-unsigned long genrand_int32(void)
-{
-    unsigned long y;
-    static unsigned long mag01[2]={0x0UL, MATRIX_A};
-    /* mag01[x] = x * MATRIX_A  for x=0,1 */
-
-    if (mti >= N) { /* generate N words at one time */
-        int kk;
-
-        if (mti == N+1)   /* if init_genrand() has not been called, */
-            init_genrand(5489UL); /* a default initial seed is used */
-
-        for (kk=0;kk<N-M;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+M] ^ (y >> 1) ^ mag01[y & 0x1UL];
-        }
-        for (;kk<N-1;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+(M-N)] ^ (y >> 1) ^ mag01[y & 0x1UL];
-        }
-        y = (mt[N-1]&UPPER_MASK)|(mt[0]&LOWER_MASK);
-        mt[N-1] = mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1UL];
-
-        mti = 0;
-    }
-
-    y = mt[mti++];
-
-    /* Tempering */
-    y ^= (y >> 11);
-    y ^= (y << 7) & 0x9d2c5680UL;
-    y ^= (y << 15) & 0xefc60000UL;
-    y ^= (y >> 18);
-
-    return y;
-}
-
-/* generates a random number on [0,0x7fffffff]-interval */
-long genrand_int31(void)
-{
-    return (long)(genrand_int32()>>1);
-}
-
-/* generates a random number on [0,1]-real-interval */
-double genrand_real1(void)
-{
-    return genrand_int32()*(1.0/4294967295.0);
-    /* divided by 2^32-1 */
-}
-
-/* generates a random number on [0,1)-real-interval */
-double genrand_real2(void)
-{
-    return genrand_int32()*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on (0,1)-real-interval */
-double genrand_real3(void)
-{
-    return (((double)genrand_int32()) + 0.5)*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on [0,1) with 53-bit resolution*/
-double genrand_res53(void)
-{
-    unsigned long a=genrand_int32()>>5, b=genrand_int32()>>6;
-    return(a*67108864.0+b)*(1.0/9007199254740992.0);
-}
diff --git a/Source/JavaScriptCore/wtf/wtf.pri b/Source/JavaScriptCore/wtf/wtf.pri
index 8535ef3..3be3b5f 100644
--- a/Source/JavaScriptCore/wtf/wtf.pri
+++ b/Source/JavaScriptCore/wtf/wtf.pri
@@ -3,6 +3,7 @@
 SOURCES += \
     wtf/Assertions.cpp \
     wtf/ByteArray.cpp \
+    wtf/CryptographicallyRandomNumber.cpp \
     wtf/CurrentTime.cpp \
     wtf/DateMath.cpp \
     wtf/dtoa.cpp \
@@ -14,6 +15,7 @@ SOURCES += \
     wtf/MD5.cpp \
     wtf/MainThread.cpp \
     wtf/NullPtr.cpp \
+    wtf/OSRandomSource.cpp \
     wtf/qt/MainThreadQt.cpp \
     wtf/qt/StringQt.cpp \
     wtf/qt/ThreadingQt.cpp \
@@ -22,6 +24,7 @@ SOURCES += \
     wtf/RandomNumber.cpp \
     wtf/RefCountedLeakCounter.cpp \
     wtf/StackBounds.cpp \
+    wtf/TCSystemAlloc.cpp \
     wtf/ThreadingNone.cpp \
     wtf/Threading.cpp \
     wtf/TypeTraits.cpp \
@@ -42,10 +45,6 @@ contains(DEFINES, USE_GSTREAMER=1) {
     CONFIG += link_pkgconfig
 }
 
-!contains(DEFINES, USE_SYSTEM_MALLOC=1) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
-
 unix:!symbian: SOURCES += wtf/OSAllocatorPosix.cpp
 symbian: SOURCES += wtf/OSAllocatorSymbian.cpp
 win*|wince*: SOURCES += wtf/OSAllocatorWin.cpp
diff --git a/Source/JavaScriptCore/wtf/wx/StringWx.cpp b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
index 59d500b..fe0fd89 100644
--- a/Source/JavaScriptCore/wtf/wx/StringWx.cpp
+++ b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-#include "PlatformString.h"
 
-#include <unicode/ustring.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
 #include <wx/defs.h>
 #include <wx/string.h>
 
@@ -39,7 +39,7 @@ String::String(const wxString& wxstr)
     #error "This code only works in Unicode build of wxWidgets"
 #endif
 
-#if SIZEOF_WCHAR_T == sizeof(UChar)
+#if SIZEOF_WCHAR_T == U_SIZEOF_UCHAR
 
     m_impl = StringImpl::create(wxstr.wc_str(), wxstr.length());
 
@@ -61,8 +61,8 @@ String::String(const wxString& wxstr)
     UChar* data;
     wxMBConvUTF16 conv;
     unsigned utf16Length = conv.FromWChar(0, 0, wideString, wideLength);
-    m_impl = StringImpl::createUninitialized(utf16Length, data)
-    conv.FromWChar(data, utf16Length, wideString, wideLength);
+    m_impl = StringImpl::createUninitialized(utf16Length, data);
+    conv.FromWChar((char*)data, utf16Length, wideString, wideLength);
 
 #endif // SIZEOF_WCHAR_T == 4
 }
diff --git a/Source/JavaScriptCore/yarr/Yarr.h b/Source/JavaScriptCore/yarr/Yarr.h
index 57176bc..de64fdd 100644
--- a/Source/JavaScriptCore/yarr/Yarr.h
+++ b/Source/JavaScriptCore/yarr/Yarr.h
@@ -29,7 +29,6 @@
 #define Yarr_h
 
 #include "YarrInterpreter.h"
-#include "YarrJIT.h"
 #include "YarrPattern.h"
 
 namespace JSC { namespace Yarr {
@@ -61,11 +60,6 @@ enum JSRegExpResult {
 PassOwnPtr<BytecodePattern> byteCompile(YarrPattern&, BumpPointerAllocator*);
 int interpret(BytecodePattern*, const UChar* input, unsigned start, unsigned length, int* output);
 
-#if ENABLE(YARR_JIT)
-void jitCompile(YarrPattern&, JSGlobalData*, YarrCodeBlock& jitObject);
-int execute(YarrCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output);
-#endif
-
 } } // namespace JSC::Yarr
 
 #endif // Yarr_h
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index d2dbf23..37d44f7 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -203,7 +203,7 @@ public:
         int readChecked(int position)
         {
             ASSERT(position < 0);
-            ASSERT((unsigned)-position <= pos);
+            ASSERT(static_cast<unsigned>(-position) <= pos);
             unsigned p = pos + position;
             ASSERT(p < length);
             return input[p];
@@ -248,8 +248,8 @@ public:
             if ((pos + count) <= length) {
                 pos += count;
                 return true;
-            } else
-                return false;
+            }
+            return false;
         }
 
         void uncheckInput(int count)
@@ -356,8 +356,8 @@ public:
     {
         if (term.inputPosition)
             return (input.atEnd(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
-        else
-            return (input.atEnd()) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+
+        return (input.atEnd()) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.read()));
     }
 
     bool matchAssertionWordBoundary(ByteTerm& term)
@@ -577,8 +577,8 @@ public:
             if ((backTrack->matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
                 ++backTrack->matchAmount;
                 return true;
-            } else
-                input.setPos(backTrack->begin);
+            }
+            input.setPos(backTrack->begin);
             break;
         }
 
@@ -1412,7 +1412,7 @@ public:
     }
 
 private:
-    BytecodePattern *pattern;
+    BytecodePattern* pattern;
     int* output;
     InputStream input;
     BumpPointerPool* allocatorPool;
@@ -1847,7 +1847,7 @@ public:
                 case PatternTerm::TypeParentheticalAssertion: {
                     unsigned alternativeFrameLocation = term.frameLocation + YarrStackSpaceForBackTrackInfoParentheticalAssertion;
 
-                    ASSERT(currentCountAlreadyChecked >= (unsigned)term.inputPosition);
+                    ASSERT(currentCountAlreadyChecked >= static_cast<unsigned>(term.inputPosition));
                     int positiveInputOffset = currentCountAlreadyChecked - term.inputPosition;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invert(), term.frameLocation, alternativeFrameLocation);
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index 9d13d45..e34e6f4 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -27,9 +27,7 @@
 #include "YarrJIT.h"
 
 #include "ASCIICType.h"
-#include "JSGlobalData.h"
 #include "LinkBuffer.h"
-#include "MacroAssembler.h"
 #include "Yarr.h"
 
 #if ENABLE(YARR_JIT)
@@ -407,9 +405,9 @@ class YarrGenerator : private MacroAssembler {
             --m_parenNestingLevel;
         }
 
-        ParenthesesTail* addParenthesesTail(PatternTerm& term, ParenthesesTail* nextOuterParenTail)
+        ParenthesesTail* addParenthesesTail(PatternTerm& term, JumpList* jumpListToPriorParen)
         {
-            ParenthesesTail* parenthesesTail = new ParenthesesTail(term, m_parenNestingLevel, nextOuterParenTail);
+            ParenthesesTail* parenthesesTail = new ParenthesesTail(term, m_parenNestingLevel, jumpListToPriorParen);
             m_parenTails.append(parenthesesTail);
             m_parenTailsForIteration.append(parenthesesTail);
 
@@ -815,7 +813,7 @@ class YarrGenerator : private MacroAssembler {
             , checkedTotal(checkedTotal)
             , m_subParenNum(0)
             , m_linkedBacktrack(0)
-            , m_parenthesesTail(0)
+            , m_jumpList(0)
         {
         }
 
@@ -876,14 +874,14 @@ class YarrGenerator : private MacroAssembler {
             return !disjunction->m_parent;
         }
 
-        void setParenthesesTail(ParenthesesTail* parenthesesTail)
+        void setJumpListToPriorParen(JumpList* jumpList)
         {
-            m_parenthesesTail = parenthesesTail;
+            m_jumpList = jumpList;
         }
 
-        ParenthesesTail* getParenthesesTail()
+        JumpList* getJumpListToPriorParen()
         {
-            return m_parenthesesTail;
+            return m_jumpList;
         }
 
         PatternTerm& lookaheadTerm()
@@ -1018,15 +1016,15 @@ class YarrGenerator : private MacroAssembler {
         unsigned m_subParenNum;
         BacktrackDestination m_backtrack;
         BacktrackDestination* m_linkedBacktrack;
-        ParenthesesTail* m_parenthesesTail;
+        JumpList* m_jumpList;
     };
 
     struct ParenthesesTail {
-        ParenthesesTail(PatternTerm& term, int nestingLevel, ParenthesesTail* nextOuterParenTail)
+        ParenthesesTail(PatternTerm& term, int nestingLevel, JumpList* jumpListToPriorParen)
             : m_term(term)
             , m_nestingLevel(nestingLevel)
             , m_subParenIndex(0)
-            , m_nextOuterParenTail(nextOuterParenTail)
+            , m_jumpListToPriorParen(jumpListToPriorParen)
         {
         }
 
@@ -1052,7 +1050,7 @@ class YarrGenerator : private MacroAssembler {
             if (m_doDirectBacktrack)
                 state.propagateBacktrackingFrom(generator, m_parenBacktrack, false);
             else {
-                stateBacktrack.setBacktrackJumpList(&m_pattBacktrackJumps);
+                stateBacktrack.setBacktrackJumpList(&m_afterBacktrackJumps);
                 stateBacktrack.setBacktrackSourceLabel(&m_backtrackFromAfterParens);
             }
         }
@@ -1065,7 +1063,7 @@ class YarrGenerator : private MacroAssembler {
 
         void addAfterParenJump(Jump jump)
         {
-            m_pattBacktrackJumps.append(jump);
+            m_afterBacktrackJumps.append(jump);
         }
 
         bool generateCode(YarrGenerator* generator, JumpList& jumpsToNext, bool priorBackTrackFallThrough, bool nextBacktrackFallThrough)
@@ -1091,12 +1089,9 @@ class YarrGenerator : private MacroAssembler {
                 if (m_backtrackToLabel.isSet()) {
                     m_backtrack.setLabel(m_backtrackToLabel);
                     nextBacktrackFallThrough = false;
-                } else if (!m_subParenIndex && m_nextOuterParenTail) {
-                    // If we don't have a destination and we are the first term of a nested paren, go
-                    // back to the outer paren.
-                    // There is an optimization if the next outer paren is the next paren to be emitted.
-                    // In that case we really want the else clause.
-                    m_backtrack.setBacktrackJumpList(&m_nextOuterParenTail->m_withinBacktrackJumps);
+                } else if (m_jumpListToPriorParen) {
+                    // If we don't have a destination, go back to either the prior paren or the next outer paren.
+                    m_backtrack.setBacktrackJumpList(m_jumpListToPriorParen);
                     nextBacktrackFallThrough = false;
                 } else
                     m_backtrack.setBacktrackJumpList(&jumpsToNext);
@@ -1109,7 +1104,7 @@ class YarrGenerator : private MacroAssembler {
             if (m_dataAfterLabelPtr.isSet())
                 generator->m_expressionState.m_backtrackRecords.append(AlternativeBacktrackRecord(m_dataAfterLabelPtr, m_backtrackFromAfterParens));
 
-            m_pattBacktrackJumps.link(generator);
+            m_afterBacktrackJumps.link(generator);
 
             if (m_term.quantityType == QuantifierGreedy) {
                 // If this is -1 we have now tested with both with and without the parens.
@@ -1149,14 +1144,14 @@ class YarrGenerator : private MacroAssembler {
         PatternTerm& m_term;
         int m_nestingLevel;
         unsigned m_subParenIndex;
-        ParenthesesTail* m_nextOuterParenTail;
+        JumpList* m_jumpListToPriorParen;
         Label m_nonGreedyTryParentheses;
         Label m_fallThrough;
         Label m_backtrackToLabel;
         Label m_backtrackFromAfterParens;
         DataLabelPtr m_dataAfterLabelPtr;
-        JumpList m_pattBacktrackJumps;
         JumpList m_withinBacktrackJumps;
+        JumpList m_afterBacktrackJumps;
         BacktrackDestination m_parenBacktrack;
         BacktrackDestination m_backtrack;
         bool m_doDirectBacktrack;
@@ -1581,8 +1576,10 @@ class YarrGenerator : private MacroAssembler {
             JumpList successes;
             bool propogateBacktrack = false;
 
-            for (state.resetAlternative(); state.alternativeValid(); state.nextAlternative()) {
+            // Save current state's paren jump list for use with each alternative 
+            JumpList* outerJumpList = state.getJumpListToPriorParen();
 
+            for (state.resetAlternative(); state.alternativeValid(); state.nextAlternative(), state.setJumpListToPriorParen(outerJumpList)) {
                 PatternAlternative* alternative = state.alternative();
                 optimizeAlternative(alternative);
 
@@ -1649,9 +1646,9 @@ class YarrGenerator : private MacroAssembler {
             m_expressionState.incrementParenNestingLevel();
 
             TermGenerationState parenthesesState(disjunction, state.checkedTotal);
-            
-            // Use the current paren Tail to connect the nested parentheses.
-            parenthesesState.setParenthesesTail(state.getParenthesesTail());
+
+            // Use the current state's jump list for the nested parentheses.
+            parenthesesState.setJumpListToPriorParen(state.getJumpListToPriorParen());
 
             generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
             // this expects that any backtracks back out of the parentheses will be in the
@@ -1663,6 +1660,8 @@ class YarrGenerator : private MacroAssembler {
             state.propagateBacktrackingFrom(this, parenthesesBacktrack);
             stateBacktrack.propagateBacktrackToLabel(parenthesesBacktrack);
 
+            state.setJumpListToPriorParen(parenthesesState.getJumpListToPriorParen());
+
             m_expressionState.decrementParenNestingLevel();
         } else {
             Jump nonGreedySkipParentheses;
@@ -1687,14 +1686,14 @@ class YarrGenerator : private MacroAssembler {
                     store32(index, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
             }
 
-            ParenthesesTail* parenthesesTail = m_expressionState.addParenthesesTail(term, state.getParenthesesTail());
+            ParenthesesTail* parenthesesTail = m_expressionState.addParenthesesTail(term, state.getJumpListToPriorParen());
 
             m_expressionState.incrementParenNestingLevel();
 
             TermGenerationState parenthesesState(disjunction, state.checkedTotal);
 
             // Save the parenthesesTail for backtracking from nested parens to this one.
-            parenthesesState.setParenthesesTail(parenthesesTail);
+            parenthesesState.setJumpListToPriorParen(&parenthesesTail->m_withinBacktrackJumps);
 
             // generate the body of the parentheses
             generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
@@ -1718,6 +1717,8 @@ class YarrGenerator : private MacroAssembler {
 
             parenthesesTail->processBacktracks(this, state, parenthesesState, nonGreedyTryParentheses, label());
 
+            state.setJumpListToPriorParen(&parenthesesTail->m_afterBacktrackJumps);
+            
             parenthesesState.getBacktrackDestination().clear();
 
             if (term.quantityType == QuantifierNonGreedy)
@@ -1977,6 +1978,7 @@ class YarrGenerator : private MacroAssembler {
 
             // if there are any more alternatives, plant the check for input before looping.
             if (state.alternativeValid()) {
+                state.setJumpListToPriorParen(0);
                 PatternAlternative* nextAlternative = state.alternative();
                 if (!setRepeatAlternativeLabels && !nextAlternative->onceThrough()) {
                     // We have handled non-repeating alternatives, jump to next iteration 
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.h b/Source/JavaScriptCore/yarr/YarrJIT.h
index 414b575..91c5b85 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.h
+++ b/Source/JavaScriptCore/yarr/YarrJIT.h
@@ -28,8 +28,10 @@
 
 #if ENABLE(YARR_JIT)
 
+#include "JSGlobalData.h"
 #include "MacroAssembler.h"
 #include "UString.h"
+#include "YarrPattern.h"
 
 #if CPU(X86) && !COMPILER(MSVC)
 #define YARR_CALL __attribute__ ((regparm (3)))
@@ -75,6 +77,9 @@ private:
     bool m_needFallBack;
 };
 
+void jitCompile(YarrPattern&, JSGlobalData*, YarrCodeBlock& jitObject);
+int execute(YarrCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output);
+
 } } // namespace JSC::Yarr
 
 #endif
diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
index 8c5741a..c59310a 100644
--- a/Source/JavaScriptCore/yarr/YarrParser.h
+++ b/Source/JavaScriptCore/yarr/YarrParser.h
@@ -26,7 +26,7 @@
 #ifndef YarrParser_h
 #define YarrParser_h
 
-#include "UString.h"
+#include <runtime/UString.h>
 #include "Yarr.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/unicode/Unicode.h>
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.cpp b/Source/JavaScriptCore/yarr/YarrPattern.cpp
index 112b65d..3d6dbd3 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.cpp
+++ b/Source/JavaScriptCore/yarr/YarrPattern.cpp
@@ -488,24 +488,56 @@ public:
         m_alternative = m_alternative->m_parent->m_parent;
 
         PatternTerm& lastTerm = m_alternative->lastTerm();
-        
+
         unsigned numParenAlternatives = parenthesesDisjunction->m_alternatives.size();
         unsigned numBOLAnchoredAlts = 0;
-        // Bubble up BOL flags
+        bool containsEmptyAlternative = false;
+
         for (unsigned i = 0; i < numParenAlternatives; i++) {
+            if (!parenthesesDisjunction->m_alternatives[i]->m_terms.size() && numParenAlternatives > 1) {
+                parenthesesDisjunction->m_alternatives.remove(i);
+                --numParenAlternatives;
+
+                containsEmptyAlternative = true;
+                continue;
+            }
+
+            // Bubble up BOL flags
             if (parenthesesDisjunction->m_alternatives[i]->m_startsWithBOL)
                 numBOLAnchoredAlts++;
         }
-        
+
         if (numBOLAnchoredAlts) {
             m_alternative->m_containsBOL = true;
             // If all the alternatives in parens start with BOL, then so does this one
             if (numBOLAnchoredAlts == numParenAlternatives)
                 m_alternative->m_startsWithBOL = true;
         }
-        
+
         lastTerm.parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
         m_invertParentheticalAssertion = false;
+
+        if (containsEmptyAlternative) {
+            // Backup and remove the current disjunction's alternatives.
+            Vector<PatternAlternative*> alternatives;
+            alternatives.append(parenthesesDisjunction->m_alternatives);
+            parenthesesDisjunction->m_alternatives.clear();
+            PatternAlternative* alternative = parenthesesDisjunction->addNewAlternative();
+
+            // Insert a new non-capturing parentheses.
+            unsigned subpatternId = m_pattern.m_numSubpatterns + 1;
+            PatternDisjunction* newDisjunction = new PatternDisjunction(alternative);
+            m_pattern.m_disjunctions.append(newDisjunction);
+            alternative->m_terms.append(PatternTerm(PatternTerm::TypeParenthesesSubpattern, subpatternId, newDisjunction, false, false));
+            newDisjunction->m_alternatives.append(alternatives);
+
+            // Set the quantifier of the new parentheses to '?' and set the inherited properties.
+            PatternTerm& disjunctionTerm = alternative->lastTerm();
+            disjunctionTerm.quantify(1, QuantifierGreedy);
+            disjunctionTerm.parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
+            alternative->m_containsBOL = m_alternative->m_containsBOL;
+            alternative->m_startsWithBOL = m_alternative->m_startsWithBOL;
+        }
     }
 
     void atomBackReference(unsigned subpatternId)
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.h b/Source/JavaScriptCore/yarr/YarrPattern.h
index d80f692..cfe804f 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.h
+++ b/Source/JavaScriptCore/yarr/YarrPattern.h
@@ -27,11 +27,10 @@
 #ifndef YarrPattern_h
 #define YarrPattern_h
 
+#include <runtime/UString.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
-#include <UString.h>
-
 namespace JSC { namespace Yarr {
 
 struct PatternDisjunction;
diff --git a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
index e48cb9e..2013671 100644
--- a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
+++ b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
@@ -26,7 +26,7 @@
 #ifndef YarrSyntaxChecker_h
 #define YarrSyntaxChecker_h
 
-#include <UString.h>
+#include <runtime/UString.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/Source/JavaScriptCore/yarr/yarr.pri b/Source/JavaScriptCore/yarr/yarr.pri
new file mode 100644
index 0000000..a7b1242
--- /dev/null
+++ b/Source/JavaScriptCore/yarr/yarr.pri
@@ -0,0 +1,7 @@
+# Yet Another Regex Runtime - Qt4 build info
+
+SOURCES += \
+    yarr/YarrInterpreter.cpp \
+    yarr/YarrPattern.cpp \
+    yarr/YarrSyntaxChecker.cpp
+