Merge WebKit at r76408: Initial merge by git.

Change-Id: I5b91decbd693ccbf5c1b8354b37cd68cc9a1ea53

112 files changed, 1358 insertions, 459 deletions

diff --git a/Source/JavaScriptCore/API/JSClassRef.h b/Source/JavaScriptCore/API/JSClassRef.h
index 5062093..0971700 100644
--- a/Source/JavaScriptCore/API/JSClassRef.h
+++ b/Source/JavaScriptCore/API/JSClassRef.h
@@ -34,7 +34,9 @@
 #include <runtime/WeakGCPtr.h>
 #include <wtf/HashMap.h>
 
-struct StaticValueEntry : FastAllocBase {
+struct StaticValueEntry {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     StaticValueEntry(JSObjectGetPropertyCallback _getProperty, JSObjectSetPropertyCallback _setProperty, JSPropertyAttributes _attributes)
         : getProperty(_getProperty), setProperty(_setProperty), attributes(_attributes)
     {
@@ -45,7 +47,9 @@ struct StaticValueEntry : FastAllocBase {
     JSPropertyAttributes attributes;
 };
 
-struct StaticFunctionEntry : FastAllocBase {
+struct StaticFunctionEntry {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     StaticFunctionEntry(JSObjectCallAsFunctionCallback _callAsFunction, JSPropertyAttributes _attributes)
         : callAsFunction(_callAsFunction), attributes(_attributes)
     {
@@ -62,7 +66,9 @@ struct OpaqueJSClass;
 
 // An OpaqueJSClass (JSClass) is created without a context, so it can be used with any context, even across context groups.
 // This structure holds data members that vary across context groups.
-struct OpaqueJSClassContextData : Noncopyable {
+struct OpaqueJSClassContextData {
+    WTF_MAKE_NONCOPYABLE(OpaqueJSClassContextData); WTF_MAKE_FAST_ALLOCATED;
+public:
     OpaqueJSClassContextData(OpaqueJSClass*);
     ~OpaqueJSClassContextData();
 
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index 4198ca8..d6de426 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -480,7 +480,9 @@ JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size
     return result;
 }
 
-struct OpaqueJSPropertyNameArray : FastAllocBase {
+struct OpaqueJSPropertyNameArray {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     OpaqueJSPropertyNameArray(JSGlobalData* globalData)
         : refCount(0)
         , globalData(globalData)
diff --git a/Source/JavaScriptCore/Android.mk b/Source/JavaScriptCore/Android.mk
index 9f5c1ce..052af2c 100644
--- a/Source/JavaScriptCore/Android.mk
+++ b/Source/JavaScriptCore/Android.mk
@@ -160,6 +160,7 @@ LOCAL_SRC_FILES := \
 	runtime/StringConstructor.cpp \
 	runtime/StringObject.cpp \
 	runtime/StringPrototype.cpp \
+	runtime/StringRecursionChecker.cpp \
 	runtime/Structure.cpp \
 	runtime/StructureChain.cpp \
 	runtime/TimeoutChecker.cpp \
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 29de8a7..674d272 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -163,6 +163,7 @@ SET(JavaScriptCore_SOURCES
     runtime/StringConstructor.cpp
     runtime/StringObject.cpp
     runtime/StringPrototype.cpp
+    runtime/StringRecursionChecker.cpp
     runtime/Structure.cpp
     runtime/StructureChain.cpp
     runtime/TimeoutChecker.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 9d92e9d..a5391bf 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,484 @@
+2011-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [RegexFuzz] Hang with forward assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52825
+        <rdar://problem/8894332>
+
+        The backtrackTo label from the first term in a list of terms is
+        being overwritten by processing of subsequent terms.  Changed
+        copyBacktrackToLabel() to check for an existing bcaktrackTo label
+        before copying and renamed it to propagateBacktrackToLabel() since
+        it no longer copies.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved the mark stack from global data to the heap, since it pertains
+        to the heap, and not the virtual machine as a whole.
+        https://bugs.webkit.org/show_bug.cgi?id=52930
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2011-01-21  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76177): All JavaScriptCore tests fail on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=52814
+
+        Get the approximateByteSize value before releasing the OwnPtr.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove unnecessary <stdio.h> include
+        https://bugs.webkit.org/show_bug.cgi?id=52884
+
+        * jit/JIT.cpp: remove unnecessary include.
+
+2011-01-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added OwnPtrCommon.h because OwnArrayPtr::set calls deleteOwnedPtr.
+
+        * wtf/OwnArrayPtr.h:
+
+2011-01-20  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [WINCE] Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52450
+
+        Remove the "offset hack" in create_jit_stubs, since we
+        only support JSVALUE32_64 in the meantime.
+
+        * create_jit_stubs: Removed offset argument
+        * jit/JITStubs.cpp:
+
+2011-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When marking conservatively, guard against reviving dead objects.
+        https://bugs.webkit.org/show_bug.cgi?id=52840
+        
+        SunSpider and v8 say no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markCallFrames): Updated to use the ConservativeSet API.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::recordExtraCost): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors): Don't drain the mark stack inside a
+        marking function. We want to establish a separation of concerns between
+        visiting roots and draining the mark stack.
+
+        (JSC::Heap::markRoots): Gather the set of conservative references before
+        clearning mark bits, because conservative marking now uses the mark bits
+        to determine if a reference is valid, and avoid reviving dead objects.
+
+        (JSC::Heap::collectAllGarbage): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        * runtime/Heap.h: Updated to use the ConservativeSet API.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markCurrentThreadConservatively):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::MachineStackMarker::markMachineStackConservatively):
+        * runtime/MachineStackMarker.h: Ditto.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Added ConservativeSet, for gathering the
+        set of conservative references. This is different from MarkStack, since
+        we don't mark the set until it is completely gathered.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::resizeBlocks):
+        (JSC::MarkedSpace::markConservatively):
+        * runtime/MarkedSpace.h: When marking conservatively, guard against
+        reviving dead objects.
+
+2011-01-20  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [Symbian] Fix StackBounds::initialize()
+        https://bugs.webkit.org/show_bug.cgi?id=52842
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize): Use TThreadStackInfo.iLimit for stack limit
+
+2011-01-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8890203> [RegexFuzz] Crash in generated code (52773)
+        https://bugs.webkit.org/show_bug.cgi?id=52773
+
+        Fixed case where an existing DataLabelPtr is overwritten.  The
+        replacing DataLabelPtr is now resolved immediately in
+        linkDataLabelToBacktrackIfExists().  Cleanup - eliminated bool
+        return value for the routine as it was never used.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+
+2011-01-20  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][WK2] WebKit2 enabled build fails to link
+
+        Work around undefined reference linking issues until the buildsystem gets redesigned.
+        These issues first occured in minimal builds (see BUG 50519).
+
+        * JavaScriptCore.pri: link as whole-archive for WebKit2 builds
+
+2011-01-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Refactoring of the custom allocation framework
+        https://bugs.webkit.org/show_bug.cgi?id=49897
+
+        Inheriting from FastAllocBase can result in objects getting larger (bug #33896, #46589).
+        The modification replaces Noncopyable and FastAllocBase classes and these inherits with their
+        equivalent macro implementation at the necessary places.
+
+        * wtf/FastAllocBase.h: Turn FastAllocBase's implementation into a macro.
+
+2011-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        We were failing to initialize the key, causing all sorts of unexpected behavior.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::setThreadHeap):
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap):
+        (WTF::TCMalloc_ThreadCache::InitTSD): Ensure that the key is initialized.
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rolled back in r76078, with crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Account for the fact that the global
+        object moves its variables into and out of the register file. While out
+        of the register file, the symbol table's size is not an accurate count
+        for the size of the register array, since the BytecodeGenerator might
+        be compiling, adding items to the symbol table.
+        
+2011-01-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Stack overflow when converting an Error object to string
+        https://bugs.webkit.org/show_bug.cgi?id=46410
+
+        * Android.mk: Added StringRecursionChecker.cpp and
+        StringRecursionChecker.h.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.pro: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use StringRecursionChecker instead
+        of the older hand-written code to do the same thing.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/JSGlobalData.h: Renamed arrayVisitedElements to
+        stringRecursionCheckVisitedObjects.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/StringRecursionChecker.cpp: Added.
+        * runtime/StringRecursionChecker.h: Added.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove non-spec support for callable RegExp
+        https://bugs.webkit.org/show_bug.cgi?id=28285
+
+        Remove support for callable regexps.  If it breaks sites we can
+        just roll this out.
+
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * tests/mozilla/expected.html: update results.
+
+2011-01-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache function offsets to speed up javascript parsing
+        https://bugs.webkit.org/show_bug.cgi?id=52622
+        
+        Use cache to save function offsets and some other info.
+        This avoids quite a bit of work when reparsing the source.
+
+        * parser/ASTBuilder.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::CachedFunctionInfo::CachedFunctionInfo):
+        (JSC::JSParser::CachedFunctionInfo::approximateByteSize):
+        (JSC::JSParser::CachedFunctionInfo::closeBraceToken):
+        (JSC::JSParser::Scope::copyCapturedVariablesToVector):
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+        (JSC::Lexer::setLineNumber):
+        (JSC::Lexer::sourceProvider):
+        * parser/SourceProvider.h:
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::~SourceProvider):
+        (JSC::SourceProvider::cache):
+        (JSC::SourceProvider::notifyCacheSizeChanged):
+        (JSC::SourceProvider::cacheSizeChanged):
+        * parser/SyntaxChecker.h:
+
+2011-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        * DerivedSources.make: Evaluate the SDKROOT variable correctly.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52672
+
+        Rather than coming up with a somewhat convoluted mechanism to ensure that
+        developers can override the global objects prototype with a function named
+        __proto__ and expect it to work, we just disallow it at the syntax level.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-19  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8882994> Regression: Simple nested backtrack hangs
+        https://bugs.webkit.org/show_bug.cgi?id=52675
+
+        The changeset (r76076) for https://bugs.webkit.org/show_bug.cgi?id=52540
+        broke simple backtracking in some cases.  Reworked that change to 
+        link both jumps and labels.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-19  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [JSC] scripts have incorrect starting line (always 1).
+        https://bugs.webkit.org/show_bug.cgi?id=52721
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/Debugger.h:
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::startPosition):
+
+2011-01-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Laszlo Gombos and Tor Arne Vestbø.
+
+        [Qt] Remove unnecessary "../Source" from paths
+        after moving source files into Source is finished.
+
+        * JavaScriptCore.pri:
+
+2011-01-19  Benjamin Kalman  <kalman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Don't return void from void function String::split
+        https://bugs.webkit.org/show_bug.cgi?id=52684
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+
+2011-01-18  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r76078.
+        http://trac.webkit.org/changeset/76078
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        Caused crashes of fast/canvas/webgl/constants.html,
+        fast/canvas/webgl/gl-enum-tests.html, and possibly other layout
+        test crashes in Release mode. WebGL crashes were observed with
+        "run-webkit-tests fast/canvas/webgl". It was necessary to run
+        multiple tests to provoke the crash.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren):
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
+        https://bugs.webkit.org/show_bug.cgi?id=52690
+
+        Clean up code to retrieve arguments from activation and function objects.
+        Remove the incorrect assertion from JSActivation's argumentsGetter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed RegisterFile::markGlobals because it was obtuse, and it
+        unnecessarily relied on conservative marking.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        * interpreter/RegisterFile.h: Removed markGlobals.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren): Added a comment explaning why some
+        JSActivations don't always mark their registers arrays.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Instead of calling markGlobals, mark
+        the registers array directly.
+
+2011-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
+        https://bugs.webkit.org/show_bug.cgi?id=52540
+        https://bugs.webkit.org/show_bug.cgi?id=52662
+
+        Directly use backtrack label with parentheses nested under a
+        non-capturing parentheses.  Also linked current parentheses
+        tail code object for possible parens nested within a non-capturing
+        parentheses.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Only use moving memory model assumption in ExecutableAllocator::intializePageSize() for Symbian OS
+        https://bugs.webkit.org/show_bug.cgi?id=52517
+
+        Patch by David Tapuska
+
+        Currently, we compile code with respect to the Symbian-specific moving memory model
+        assumption for all ARMv5 or lower architectures. Instead, we should only compile
+        such code when building for Symbian OS on those architectures because this model
+        is Symbian-specific.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+
+2011-01-18  Dimitry Andric  <dim@freebsd.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix linking JavaScriptCore on FreeBSD/amd64
+        https://bugs.webkit.org/show_bug.cgi?id=52591
+
+        Linking of JavaScriptCore on FreeBSD/amd64 fails, for the same reason as
+        in bug 28422: cti_vm_throw needs a "@plt" suffix, otherwise the linker
+        complains about the relocation type.
+
+        * jit/JITStubs.cpp: use @plt suffix on x86_64 platforms, for both Linux
+        and FreeBSD.
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        [jsfunfuzz] Assertion in codegen for array of NaN constants
+        https://bugs.webkit.org/show_bug.cgi?id=52643
+
+        Don't cache NaN literals in the code generator, as NaN doesn't compare
+        as equal to itself it causes problems when rehashing the number cache.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
 2011-01-17  Jarred Nicholls  <jarred@sencha.com>
 
         Reviewed by Csaba Osztrogonác.
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 4de4a88..748e254 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -88,4 +88,4 @@ JavaScriptCore.JSVALUE64.exp: JavaScriptCore.exp JavaScriptCore.JSVALUE64only.ex
 # header detection
 
 HeaderDetection.h : DerivedSources.make
-	if [ -f $SDKROOT/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" > $@; else echo > $@; fi
+	if [ -f $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" > $@; else echo > $@; fi
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index 4c8d204..7272471 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -404,6 +404,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
 	Source/JavaScriptCore/runtime/StringPrototype.cpp \
 	Source/JavaScriptCore/runtime/StringPrototype.h \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.cpp \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.h \
 	Source/JavaScriptCore/runtime/StructureChain.cpp \
 	Source/JavaScriptCore/runtime/StructureChain.h \
 	Source/JavaScriptCore/runtime/Structure.cpp \
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index a08b439..6ca18a0 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -337,6 +337,8 @@
             'runtime/StringObjectThatMasqueradesAsUndefined.h',
             'runtime/StringPrototype.cpp',
             'runtime/StringPrototype.h',
+            'runtime/StringRecursionChecker.cpp',
+            'runtime/StringRecursionChecker.h',
             'runtime/Structure.cpp',
             'runtime/Structure.h',
             'runtime/StructureChain.cpp',
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index 222f664..a816c97 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -23,7 +23,6 @@ CONFIG(standalone_package): DEFINES *= NDEBUG
 JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD \
     $$PWD/.. \
-    $$PWD/../.. \ # FIXME: Remove this include once we finish moving the source to Source
     $$PWD/assembler \
     $$PWD/bytecode \
     $$PWD/bytecompiler \
@@ -89,7 +88,12 @@ defineTest(addJavaScriptCoreLib) {
         # Make sure jscore will be early in the list of libraries to workaround a bug in MinGW
         # that can't resolve symbols from QtCore if libjscore comes after.
         QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
-        LIBS += -l$$JAVASCRIPTCORE_TARGET
+        webkit2 {
+            # FIXME Workaround for undefined reference linking issues until the build system gets redesigned
+            LIBS += -Wl,-whole-archive -l$$JAVASCRIPTCORE_TARGET -Wl,-no-whole-archive
+        } else {
+            LIBS += -l$$JAVASCRIPTCORE_TARGET
+        }
         POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}lib$${JAVASCRIPTCORE_TARGET}.a
     }
 
diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro
index ca420d2..9d254b7 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pro
+++ b/Source/JavaScriptCore/JavaScriptCore.pro
@@ -205,6 +205,7 @@ SOURCES += \
     runtime/StringConstructor.cpp \
     runtime/StringObject.cpp \
     runtime/StringPrototype.cpp \
+    runtime/StringRecursionChecker.cpp \
     runtime/StructureChain.cpp \
     runtime/Structure.cpp \
     runtime/TimeoutChecker.cpp \
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 1ddc251..12310d8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1246,6 +1246,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\runtime\StringRecursionChecker.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\runtime\StringRecursionChecker.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\runtime\Structure.cpp"
 				>
 			</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 0f9b4ab..358e38c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -294,6 +294,7 @@
 		932F5BEA0822A1C700736975 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		933040040E6A749400786E6A /* SmallStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 93303FEA0E6A72C000786E6A /* SmallStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93303FE80E6A72B500786E6A /* SmallStrings.cpp */; };
+		9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */; };
 		933F5CDC1269229B0049191E /* NullPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 933F5CDB126922690049191E /* NullPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		937013480CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */; settings = {COMPILER_FLAGS = "-Wno-sign-compare"; }; };
 		93854A9A12C93D3B00DAAF77 /* NullPtr.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93854A9912C93D3B00DAAF77 /* NullPtr.cpp */; };
@@ -925,6 +926,8 @@
 		932F5BE10822A1C700736975 /* jsc */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = jsc; sourceTree = BUILT_PRODUCTS_DIR; };
 		93303FE80E6A72B500786E6A /* SmallStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmallStrings.cpp; sourceTree = "<group>"; };
 		93303FEA0E6A72C000786E6A /* SmallStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmallStrings.h; sourceTree = "<group>"; };
+		93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringRecursionChecker.cpp; sourceTree = "<group>"; };
+		93345A8812D838C400302BE3 /* StringRecursionChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringRecursionChecker.h; sourceTree = "<group>"; };
 		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
 		933A349D038AE80F008635CE /* Identifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Identifier.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		933F5CDB126922690049191E /* NullPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullPtr.h; sourceTree = "<group>"; };
@@ -1867,6 +1870,8 @@
 				BC18C3C40E16EE3300B34460 /* StringObjectThatMasqueradesAsUndefined.h */,
 				BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */,
 				BC18C3C60E16EE3300B34460 /* StringPrototype.h */,
+				93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */,
+				93345A8812D838C400302BE3 /* StringRecursionChecker.h */,
 				BCDE3AB00E6C82CF001453A7 /* Structure.cpp */,
 				BCDE3AB10E6C82CF001453A7 /* Structure.h */,
 				7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */,
@@ -2873,6 +2878,7 @@
 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
+				9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index e38b9d4..c5a7d5b 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -50,7 +50,8 @@ namespace JSC {
 //   * The address of a Label pointing into the code may be resolved.
 //   * The value referenced by a DataLabel may be set.
 //
-class LinkBuffer : public Noncopyable {
+class LinkBuffer {
+    WTF_MAKE_NONCOPYABLE(LinkBuffer);
     typedef MacroAssemblerCodeRef CodeRef;
     typedef MacroAssemblerCodePtr CodePtr;
     typedef MacroAssembler::Label Label;
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 7eca72a..1cd0863 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -242,7 +242,8 @@ namespace JSC {
     }
 #endif
 
-    class CodeBlock : public FastAllocBase {
+    class CodeBlock {
+        WTF_MAKE_FAST_ALLOCATED;
         friend class JIT;
     protected:
         CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable, bool isConstructor);
@@ -578,7 +579,9 @@ namespace JSC {
 
         SymbolTable* m_symbolTable;
 
-        struct RareData : FastAllocBase {
+        struct RareData {
+           WTF_MAKE_FAST_ALLOCATED;
+        public:
             Vector<HandlerInfo> m_exceptionHandlers;
 
             // Rare Constants
@@ -599,6 +602,9 @@ namespace JSC {
             Vector<CallReturnOffsetToBytecodeOffset> m_callReturnIndexVector;
 #endif
         };
+#if PLATFORM(WIN)
+        friend void WTF::deleteOwnedPtr<RareData>(RareData*);
+#endif
         OwnPtr<RareData> m_rareData;
     };
 
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index c6468a5..f077cbf 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -54,7 +54,9 @@ namespace JSC {
     class StructureChain;
 
     // Structure used by op_get_by_id_self_list and op_get_by_id_proto_list instruction to hold data off the main opcode stream.
-    struct PolymorphicAccessStructureList : FastAllocBase {
+    struct PolymorphicAccessStructureList {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
         struct PolymorphicStubInfo {
             bool isChain;
             PolymorphicAccessStructureListStubRoutineType stubRoutine;
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index 8e3ed9e..9ca54da 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -142,7 +142,8 @@ namespace JSC {
         friend class HostCallRecord;
         
 #if ENABLE(OPCODE_SAMPLING)
-        class CallRecord : public Noncopyable {
+        class CallRecord {
+            WTF_MAKE_NONCOPYABLE(CallRecord);
         public:
             CallRecord(SamplingTool* samplingTool)
                 : m_samplingTool(samplingTool)
@@ -172,7 +173,8 @@ namespace JSC {
             }
         };
 #else
-        class CallRecord : public Noncopyable {
+        class CallRecord {
+            WTF_MAKE_NONCOPYABLE(CallRecord);
         public:
             CallRecord(SamplingTool*)
             {
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 34afb52..78c373a 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -1082,8 +1082,9 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
 RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
 {
     // FIXME: Our hash tables won't hold infinity, so we make a new JSNumberCell each time.
-    // Later we can do the extra work to handle that like the other cases.
-    if (number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
+    // Later we can do the extra work to handle that like the other cases.  They also don't
+    // work correctly with NaN as a key.
+    if (isnan(number) || number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
         return emitLoad(dst, jsNumber(number));
     JSValue& valueInMap = m_numberMap.add(number, JSValue()).first->second;
     if (!valueInMap)
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 8b0cc40..de16f8e 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -40,7 +40,6 @@
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
-#include <wtf/FastAllocBase.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
@@ -85,7 +84,8 @@ namespace JSC {
         RefPtr<RegisterID> propertyRegister;
     };
 
-    class BytecodeGenerator : public FastAllocBase {
+    class BytecodeGenerator {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
diff --git a/Source/JavaScriptCore/bytecompiler/RegisterID.h b/Source/JavaScriptCore/bytecompiler/RegisterID.h
index 3532ad8..78d49d2 100644
--- a/Source/JavaScriptCore/bytecompiler/RegisterID.h
+++ b/Source/JavaScriptCore/bytecompiler/RegisterID.h
@@ -30,12 +30,12 @@
 #define RegisterID_h
 
 #include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
 
-    class RegisterID : public Noncopyable {
+    class RegisterID {
+        WTF_MAKE_NONCOPYABLE(RegisterID);
     public:
         RegisterID()
             : m_refCount(0)
diff --git a/Source/JavaScriptCore/create_jit_stubs b/Source/JavaScriptCore/create_jit_stubs
index 4950bfc..f0fcb53 100644
--- a/Source/JavaScriptCore/create_jit_stubs
+++ b/Source/JavaScriptCore/create_jit_stubs
@@ -22,20 +22,16 @@ use strict;
 use File::Basename;
 use Getopt::Long;
 
-my $usage = basename($0) . " --prefix prefix [--offset offset] file";
+my $usage = basename($0) . " --prefix prefix file";
 
 my $rtype_template = quotemeta("#rtype#");
-my $offset_template = quotemeta(" THUNK_RETURN_ADDRESS_OFFSET");
 my $op_template = quotemeta("#op#");
 
 my $prefix;
-my $offset_is_set = 0;
-my $offset = 32;
 my $file;
 
 my $getOptionsResult = GetOptions(
-    'prefix=s' => \$prefix,
-    'offset=i' => sub { $offset_is_set = 1; $offset = $_[1]; }
+    'prefix=s' => \$prefix
 );
 
 $file = $ARGV[0];
@@ -55,9 +51,6 @@ open(IN, $file) or die "No such file $file";
 while ( $_ = <IN> ) {
     if ( /^$prefix\_BEGIN\((.*)\)/ ) {
         $stub = $1;
-        if ($offset_is_set) {
-            $stub =~ s/$offset_template/$offset/g;
-        }
         print $stub . "\n";
     }
     if ( /^$prefix\((.*)\)/ ) {
@@ -70,9 +63,6 @@ while ( $_ = <IN> ) {
         $stub = $stub_template;
         $rtype = quotemeta($1);
         $op = quotemeta($2);
-        if ($offset_is_set) {
-            $stub =~ s/$offset_template/$offset/g;
-        }
         $stub =~ s/$rtype_template/$rtype/g;
         $stub =~ s/$op_template/$op/g;
         $stub =~ s/\\\*/\*/g;
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index 6b24c5a..23b9361 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -94,7 +94,7 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     // JavaScript in the inspector.
     SourceProviderMap::const_iterator end = sourceProviders.end();
     for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed(iter->second, SourceCode(iter->first), -1, UString());
+        sourceParsed(iter->second, iter->first, -1, UString());
 }
 
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
diff --git a/Source/JavaScriptCore/debugger/Debugger.h b/Source/JavaScriptCore/debugger/Debugger.h
index 3b9bec4..ec5cf37 100644
--- a/Source/JavaScriptCore/debugger/Debugger.h
+++ b/Source/JavaScriptCore/debugger/Debugger.h
@@ -31,7 +31,7 @@ namespace JSC {
     class JSGlobalData;
     class JSGlobalObject;
     class JSValue;
-    class SourceCode;
+    class SourceProvider;
     class UString;
 
     class Debugger {
@@ -41,7 +41,7 @@ namespace JSC {
         void attach(JSGlobalObject*);
         virtual void detach(JSGlobalObject*);
 
-        virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
+        virtual void sourceParsed(ExecState*, SourceProvider*, int errorLineNumber, const UString& errorMessage) = 0;
         virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler) = 0;
         virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
diff --git a/Source/JavaScriptCore/interpreter/CachedCall.h b/Source/JavaScriptCore/interpreter/CachedCall.h
index dfbe658..740001d 100644
--- a/Source/JavaScriptCore/interpreter/CachedCall.h
+++ b/Source/JavaScriptCore/interpreter/CachedCall.h
@@ -32,7 +32,8 @@
 #include "Interpreter.h"
 
 namespace JSC {
-    class CachedCall : public Noncopyable {
+    class CachedCall {
+        WTF_MAKE_NONCOPYABLE(CachedCall); WTF_MAKE_FAST_ALLOCATED;
     public:
         CachedCall(CallFrame* callFrame, JSFunction* function, int argCount)
             : m_valid(false)
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index cf9f8a1..392e8b8 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -4802,12 +4802,13 @@ JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* functio
     if (codeBlock->usesArguments()) {
         ASSERT(codeBlock->codeType() == FunctionCode);
         int argumentsRegister = codeBlock->argumentsRegister();
-        if (!functionCallFrame->r(argumentsRegister).jsValue()) {
-            JSValue arguments = JSValue(new (callFrame) Arguments(functionCallFrame));
-            functionCallFrame->r(argumentsRegister) = arguments;
-            functionCallFrame->r(unmodifiedArgumentsRegister(argumentsRegister)) = arguments;
-        }
-        return functionCallFrame->r(argumentsRegister).jsValue();
+        int realArgumentsRegister = unmodifiedArgumentsRegister(argumentsRegister);
+        if (JSValue arguments = functionCallFrame->uncheckedR(argumentsRegister).jsValue())
+            return arguments;
+        JSValue arguments = JSValue(new (callFrame) Arguments(functionCallFrame));
+        functionCallFrame->r(argumentsRegister) = arguments;
+        functionCallFrame->r(realArgumentsRegister) = arguments;
+        return arguments;
     }
 
     Arguments* arguments = new (functionCallFrame) Arguments(functionCallFrame);
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index 47790cf..753d90e 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -30,7 +30,6 @@
 #define Interpreter_h
 
 #include "ArgList.h"
-#include "FastAllocBase.h"
 #include "JSCell.h"
 #include "JSValue.h"
 #include "JSObject.h"
@@ -65,7 +64,8 @@ namespace JSC {
 
     enum { MaxLargeThreadReentryDepth = 256, MaxSmallThreadReentryDepth = 32 };
 
-    class Interpreter : public FastAllocBase {
+    class Interpreter {
+        WTF_MAKE_FAST_ALLOCATED;
         friend class JIT;
         friend class CachedCall;
     public:
diff --git a/Source/JavaScriptCore/interpreter/Register.h b/Source/JavaScriptCore/interpreter/Register.h
index 38d1647..3944642 100644
--- a/Source/JavaScriptCore/interpreter/Register.h
+++ b/Source/JavaScriptCore/interpreter/Register.h
@@ -31,7 +31,6 @@
 
 #include "JSValue.h"
 #include <wtf/Assertions.h>
-#include <wtf/FastAllocBase.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -47,7 +46,8 @@ namespace JSC {
 
     typedef ExecState CallFrame;
 
-    class Register : public WTF::FastAllocBase {
+    class Register {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         Register();
 
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index f2e6553..9dfc432 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -89,7 +89,8 @@ namespace JSC {
 
     class JSGlobalObject;
 
-    class RegisterFile : public Noncopyable {
+    class RegisterFile {
+        WTF_MAKE_NONCOPYABLE(RegisterFile);
         friend class JIT;
     public:
         enum CallFrameHeaderEntry {
@@ -131,8 +132,7 @@ namespace JSC {
 
         Register* lastGlobal() const { return m_start - m_numGlobals; }
         
-        void markGlobals(MarkStack& markStack, Heap* heap) { heap->markConservatively(markStack, lastGlobal(), m_start); }
-        void markCallFrames(MarkStack& markStack, Heap* heap) { heap->markConservatively(markStack, m_start, m_end); }
+        void markCallFrames(ConservativeSet& conservativeSet, Heap* heap) { heap->markConservatively(conservativeSet, m_start, m_end); }
 
         static size_t committedByteCount();
         static void initializeThreading();
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
index 4530b38..fa6db83 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
@@ -37,7 +37,7 @@ size_t ExecutableAllocator::pageSize = 0;
 
 void ExecutableAllocator::intializePageSize()
 {
-#if CPU(ARMV5_OR_LOWER)
+#if OS(SYMBIAN) && CPU(ARMV5_OR_LOWER)
     // The moving memory model (as used in ARMv5 and earlier platforms)
     // on Symbian OS limits the number of chunks for each process to 16. 
     // To mitigate this limitation increase the pagesize to allocate
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 89b1e30..b8bd718 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -45,10 +45,6 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "ResultType.h"
 #include "SamplingTool.h"
 
-#ifndef NDEBUG
-#include <stdio.h>
-#endif
-
 using namespace std;
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index ded3428..9126ea7 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -79,7 +79,7 @@ namespace JSC {
 #define THUMB_FUNC_PARAM(name)
 #endif
 
-#if OS(LINUX) && CPU(X86_64)
+#if (OS(LINUX) || OS(FREEBSD)) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
 #elif OS(DARWIN)
 #define SYMBOL_STRING_RELOCATION(name) "_" #name
@@ -233,8 +233,10 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 #define EXCEPTION_OFFSET                 0x54
 #define ENABLE_PROFILER_REFERENCE_OFFSET 0x58
 
-#elif (COMPILER(GCC) || COMPILER(RVCT)) && CPU(ARM_TRADITIONAL)
+#elif (COMPILER(GCC) || COMPILER(MSVC) || COMPILER(RVCT)) && CPU(ARM_TRADITIONAL)
 
+// Also update the MSVC section (defined at DEFINE_STUB_FUNCTION)
+// when changing one of the following values.
 #define THUNK_RETURN_ADDRESS_OFFSET 64
 #define PRESERVEDR4_OFFSET          68
 
@@ -298,12 +300,6 @@ extern "C" {
     }
 }
 
-#elif COMPILER(MSVC) && CPU(ARM_TRADITIONAL)
-
-#define THUNK_RETURN_ADDRESS_OFFSET 64
-#define PRESERVEDR4_OFFSET          68
-// See DEFINE_STUB_FUNCTION for more information.
-
 #elif CPU(MIPS)
 
 #define PRESERVED_GP_OFFSET         60
@@ -533,12 +529,6 @@ extern "C" {
      }
 }
 
-#elif COMPILER(MSVC) && CPU(ARM_TRADITIONAL)
-
-#define THUNK_RETURN_ADDRESS_OFFSET 32
-#define PRESERVEDR4_OFFSET          36
-// See DEFINE_STUB_FUNCTION for more information.
-
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -1270,13 +1260,13 @@ MSVC_BEGIN()
 MSVC_BEGIN(ctiTrampoline PROC)
 MSVC_BEGIN(    stmdb sp!, {r1-r3})
 MSVC_BEGIN(    stmdb sp!, {r4-r8, lr})
-MSVC_BEGIN(    sub sp, sp, # THUNK_RETURN_ADDRESS_OFFSET + 4)
+MSVC_BEGIN(    sub sp, sp, #68 ; sync with PRESERVEDR4_OFFSET)
 MSVC_BEGIN(    mov r4, r2)
 MSVC_BEGIN(    mov r5, #512)
 MSVC_BEGIN(    ; r0 contains the code)
 MSVC_BEGIN(    mov lr, pc)
 MSVC_BEGIN(    bx r0)
-MSVC_BEGIN(    add sp, sp, # THUNK_RETURN_ADDRESS_OFFSET + 4)
+MSVC_BEGIN(    add sp, sp, #68 ; sync with PRESERVEDR4_OFFSET)
 MSVC_BEGIN(    ldmia sp!, {r4-r8, lr})
 MSVC_BEGIN(    add sp, sp, #12)
 MSVC_BEGIN(    bx lr)
@@ -1287,7 +1277,7 @@ MSVC_BEGIN(    mov r0, sp)
 MSVC_BEGIN(    mov lr, pc)
 MSVC_BEGIN(    bl cti_vm_throw)
 MSVC_BEGIN(ctiOpThrowNotCaught)
-MSVC_BEGIN(    add sp, sp, # THUNK_RETURN_ADDRESS_OFFSET + 4)
+MSVC_BEGIN(    add sp, sp, #68 ; sync with PRESERVEDR4_OFFSET)
 MSVC_BEGIN(    ldmia sp!, {r4-r8, lr})
 MSVC_BEGIN(    add sp, sp, #12)
 MSVC_BEGIN(    bx lr)
@@ -1297,9 +1287,9 @@ MSVC_BEGIN()
 MSVC(    EXPORT cti_#op#)
 MSVC(    IMPORT JITStubThunked_#op#)
 MSVC(cti_#op# PROC)
-MSVC(    str lr, [sp, # THUNK_RETURN_ADDRESS_OFFSET])
+MSVC(    str lr, [sp, #64] ; sync with THUNK_RETURN_ADDRESS_OFFSET)
 MSVC(    bl JITStubThunked_#op#)
-MSVC(    ldr lr, [sp, # THUNK_RETURN_ADDRESS_OFFSET])
+MSVC(    ldr lr, [sp, #64] ; sync with THUNK_RETURN_ADDRESS_OFFSET)
 MSVC(    bx lr)
 MSVC(cti_#op# ENDP)
 MSVC()
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index 337c87e..0e18d1d 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -108,6 +108,7 @@ public:
     
     static const bool CreatesAST = true;
     static const bool NeedsFreeVariableInfo = true;
+    static const bool CanUseFunctionCache = true;
 
     ExpressionNode* makeBinaryNode(int token, std::pair<ExpressionNode*, BinaryOpInfo>, std::pair<ExpressionNode*, BinaryOpInfo>);
     ExpressionNode* makeFunctionCallNode(ExpressionNode* func, ArgumentsNode* args, int start, int divot, int end);
diff --git a/Source/JavaScriptCore/parser/JSParser.cpp b/Source/JavaScriptCore/parser/JSParser.cpp
index 37b7f90..cb59f93 100644
--- a/Source/JavaScriptCore/parser/JSParser.cpp
+++ b/Source/JavaScriptCore/parser/JSParser.cpp
@@ -33,6 +33,7 @@ using namespace JSC;
 #include "JSGlobalData.h"
 #include "NodeInfo.h"
 #include "ASTBuilder.h"
+#include "SourceProvider.h"
 #include <wtf/HashFunctions.h>
 #include <wtf/WTFThreadData.h>
 #include <utility>
@@ -94,6 +95,39 @@ private:
         StringImpl* m_ident;
         bool m_isLoop;
     };
+    
+    struct CachedFunctionInfo : public SourceProviderCache::Item {
+        CachedFunctionInfo(int closeBraceLine, int closeBracePos)
+            : closeBraceLine(closeBraceLine) 
+            , closeBracePos(closeBracePos)
+        {
+        }
+        unsigned approximateByteSize() const
+        {
+            // The identifiers are uniqued strings so most likely there are few names that actually use any additional memory.
+            static const unsigned assummedAverageIdentifierSize = sizeof(RefPtr<StringImpl>) + 2;
+            unsigned size = sizeof(*this);
+            size += usedVariables.size() * assummedAverageIdentifierSize;
+            size += writtenVariables.size() * assummedAverageIdentifierSize;
+            return size;
+        }
+        JSToken closeBraceToken() const 
+        {
+            JSToken token;
+            token.m_type = CLOSEBRACE;
+            token.m_data.intValue = closeBracePos;
+            token.m_info.startOffset = closeBracePos;
+            token.m_info.endOffset = closeBracePos + 1;
+            token.m_info.line = closeBraceLine; 
+            return token;
+        }
+
+        int closeBraceLine;
+        int closeBracePos;
+        bool usesEval;
+        Vector<RefPtr<StringImpl> > usedVariables;
+        Vector<RefPtr<StringImpl> > writtenVariables;
+    };
 
     void next(Lexer::LexType lexType = Lexer::IdentifyReservedWords)
     {
@@ -417,6 +451,37 @@ private:
         bool strictMode() const { return m_strictMode; }
         bool isValidStrictMode() const { return m_isValidStrictMode; }
         bool shadowsArguments() const { return m_shadowsArguments; }
+        
+        void copyCapturedVariablesToVector(const IdentifierSet& capturedVariables, Vector<RefPtr<StringImpl> >& vector)
+        {
+            IdentifierSet::iterator end = capturedVariables.end();
+            for (IdentifierSet::iterator it = capturedVariables.begin(); it != end; ++it) {
+                if (m_declaredVariables.contains(*it))
+                    continue;
+                vector.append(*it);
+            }
+            vector.shrinkToFit();
+        }
+
+        void saveFunctionInfo(CachedFunctionInfo* info)
+        {
+            ASSERT(m_isFunction);
+            info->usesEval = m_usesEval;
+            copyCapturedVariablesToVector(m_writtenVariables, info->writtenVariables);
+            copyCapturedVariablesToVector(m_usedVariables, info->usedVariables);
+        }
+
+        void restoreFunctionInfo(const CachedFunctionInfo* info)
+        {
+            ASSERT(m_isFunction);
+            m_usesEval = info->usesEval;
+            unsigned size = info->usedVariables.size();
+            for (unsigned i = 0; i < size; ++i)
+                m_usedVariables.add(info->usedVariables[i]);
+            size = info->writtenVariables.size();
+            for (unsigned i = 0; i < size; ++i)
+                m_writtenVariables.add(info->writtenVariables[i]);
+        }
 
     private:
         JSGlobalData* m_globalData;
@@ -543,6 +608,13 @@ private:
     }
 
     ScopeStack m_scopeStack;
+
+    const CachedFunctionInfo* findCachedFunctionInfo(int openBracePos) 
+    {
+        return m_functionCache ? static_cast<const CachedFunctionInfo*>(m_functionCache->get(openBracePos)) : 0;
+    }
+
+    SourceProviderCache* m_functionCache;
 };
 
 const char* jsParse(JSGlobalData* globalData, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode parserMode, const SourceCode* source)
@@ -566,6 +638,7 @@ JSParser::JSParser(Lexer* lexer, JSGlobalData* globalData, FunctionParameters* p
     , m_statementDepth(0)
     , m_nonTrivialExpressionCount(0)
     , m_lastIdentifier(0)
+    , m_functionCache(m_lexer->sourceProvider()->cache())
 {
     ScopeRef scope = pushScope();
     if (isFunction)
@@ -582,6 +655,7 @@ JSParser::JSParser(Lexer* lexer, JSGlobalData* globalData, FunctionParameters* p
 
 const char* JSParser::parseProgram()
 {
+    unsigned oldFunctionCacheSize = m_functionCache ? m_functionCache->byteSize() : 0;
     ASTBuilder context(m_globalData, m_lexer);
     if (m_lexer->isReparsing())
         m_statementDepth--;
@@ -596,6 +670,10 @@ const char* JSParser::parseProgram()
         features |= StrictModeFeature;
     if (scope->shadowsArguments())
         features |= ShadowsArgumentsFeature;
+    
+    unsigned functionCacheSize = m_functionCache ? m_functionCache->byteSize() : 0;
+    if (functionCacheSize != oldFunctionCacheSize)
+        m_lexer->sourceProvider()->notifyCacheSizeChanged(functionCacheSize - oldFunctionCacheSize);
 
     m_globalData->parser->didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), features,
                                            m_lastLine, context.numConstants(), capturedVariables);
@@ -1223,6 +1301,7 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
     functionScope->setIsFunction();
     if (match(IDENT)) {
         name = m_token.m_data.ident;
+        failIfTrue(*name == m_globalData->propertyNames->underscoreProto);
         next();
         if (!nameIsInContainingScope)
             failIfFalseIfStrict(functionScope->declareVariable(name));
@@ -1238,6 +1317,23 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
 
     openBracePos = m_token.m_data.intValue;
     bodyStartLine = tokenLine();
+
+    if (const CachedFunctionInfo* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(openBracePos) : 0) {
+        // If we know about this function already, we can use the cached info and skip the parser to the end of the function.
+        body = context.createFunctionBody(strictMode());
+
+        functionScope->restoreFunctionInfo(cachedInfo);
+        failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo));
+
+        closeBracePos = cachedInfo->closeBracePos;
+        m_token = cachedInfo->closeBraceToken();
+        m_lexer->setOffset(m_token.m_info.endOffset);
+        m_lexer->setLineNumber(m_token.m_info.line);
+
+        next();
+        return true;
+    }
+
     next();
 
     body = parseFunctionBody(context);
@@ -1246,9 +1342,26 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
         failIfTrue(m_globalData->propertyNames->arguments == *name);
         failIfTrue(m_globalData->propertyNames->eval == *name);
     }
+    closeBracePos = m_token.m_data.intValue;
+    
+    // Cache the tokenizer state and the function scope the first time the function is parsed.
+    // Any future reparsing can then skip the function.
+    static const int minimumFunctionLengthToCache = 64;
+    OwnPtr<CachedFunctionInfo> newInfo;
+    int functionLength = closeBracePos - openBracePos;
+    if (TreeBuilder::CanUseFunctionCache && m_functionCache && functionLength > minimumFunctionLengthToCache) {
+        newInfo = adoptPtr(new CachedFunctionInfo(m_token.m_info.line, closeBracePos));
+        functionScope->saveFunctionInfo(newInfo.get());
+    }
+    
     failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo));
     matchOrFail(CLOSEBRACE);
-    closeBracePos = m_token.m_data.intValue;
+
+    if (newInfo) {
+        unsigned approximateByteSize = newInfo->approximateByteSize();
+        m_functionCache->add(openBracePos, newInfo.release(), approximateByteSize);
+    }
+
     next();
     return true;
 }
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index 79987af..d4145c1 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -37,7 +37,8 @@ namespace JSC {
 
     class RegExp;
 
-    class Lexer : public Noncopyable {
+    class Lexer {
+        WTF_MAKE_NONCOPYABLE(Lexer); WTF_MAKE_FAST_ALLOCATED;
     public:
         // Character manipulation functions.
         static bool isWhiteSpace(int character);
@@ -73,7 +74,15 @@ namespace JSC {
             m_current = *m_code;
             m_buffer8.resize(0);
             m_buffer16.resize(0);
+            if (UNLIKELY(m_code == m_codeEnd))
+                m_current = -1;
         }
+        void setLineNumber(int line)
+        {
+            m_lineNumber = line;
+        }
+
+        SourceProvider* sourceProvider() const { return m_source->provider(); }
 
     private:
         friend class JSGlobalData;
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index 54b7231..6e73c00 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -1376,7 +1376,9 @@ namespace JSC {
         ParameterNode* m_next;
     };
 
-    struct ScopeNodeData : FastAllocBase {
+    struct ScopeNodeData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
@@ -1472,6 +1474,7 @@ namespace JSC {
     };
 
     class FunctionParameters : public Vector<Identifier>, public RefCounted<FunctionParameters> {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         static PassRefPtr<FunctionParameters> create(ParameterNode* firstParameter) { return adoptRef(new FunctionParameters(firstParameter)); }
 
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index 213827b..58398d1 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -45,8 +45,10 @@ namespace JSC {
 
     template <typename T> struct ParserArenaData : ParserArenaDeletable { T data; };
 
-    class Parser : public Noncopyable {
+    class Parser {
+        WTF_MAKE_NONCOPYABLE(Parser); WTF_MAKE_FAST_ALLOCATED;
     public:
+        Parser() { }
         template <class ParsedNode>
         PassRefPtr<ParsedNode> parse(JSGlobalObject* lexicalGlobalObject, Debugger*, ExecState*, const SourceCode& source, FunctionParameters*, JSParserStrictness strictness, JSObject** exception);
 
@@ -119,7 +121,7 @@ namespace JSC {
         m_funcDeclarations = 0;
 
         if (debugger && !ParsedNode::scopeIsFunction)
-            debugger->sourceParsed(debuggerExecState, source, errLine, errMsg);
+            debugger->sourceParsed(debuggerExecState, source.provider(), errLine, errMsg);
         return result.release();
     }
 
diff --git a/Source/JavaScriptCore/parser/ParserArena.h b/Source/JavaScriptCore/parser/ParserArena.h
index 7c1809e..82fb808 100644
--- a/Source/JavaScriptCore/parser/ParserArena.h
+++ b/Source/JavaScriptCore/parser/ParserArena.h
@@ -34,7 +34,8 @@ namespace JSC {
     class ParserArenaDeletable;
     class ParserArenaRefCounted;
 
-    class IdentifierArena : public FastAllocBase {
+    class IdentifierArena {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         ALWAYS_INLINE const Identifier& makeIdentifier(JSGlobalData*, const UChar* characters, size_t length);
         const Identifier& makeNumericIdentifier(JSGlobalData*, double number);
@@ -59,7 +60,8 @@ namespace JSC {
         return m_identifiers.last();
     }
 
-    class ParserArena : Noncopyable {
+    class ParserArena {
+        WTF_MAKE_NONCOPYABLE(ParserArena);
     public:
         ParserArena();
         ~ParserArena();
diff --git a/Source/JavaScriptCore/parser/SourceCode.h b/Source/JavaScriptCore/parser/SourceCode.h
index a3ce759..9ba4da3 100644
--- a/Source/JavaScriptCore/parser/SourceCode.h
+++ b/Source/JavaScriptCore/parser/SourceCode.h
@@ -31,7 +31,6 @@
 
 #include "SourceProvider.h"
 #include <wtf/RefPtr.h>
-#include <wtf/text/TextPosition.h>
 
 namespace JSC {
 
@@ -42,34 +41,22 @@ namespace JSC {
             , m_startChar(0)
             , m_endChar(0)
             , m_firstLine(0)
-            , m_firstColumn(0)
         {
         }
 
-        SourceCode(PassRefPtr<SourceProvider> provider, int firstLine = 1, int firstColumn = 1)
+        SourceCode(PassRefPtr<SourceProvider> provider, int firstLine = 1)
             : m_provider(provider)
             , m_startChar(0)
             , m_endChar(m_provider->length())
             , m_firstLine(std::max(firstLine, 1))
-            , m_firstColumn(std::max(firstColumn, 1))
         {
         }
 
-        SourceCode(PassRefPtr<SourceProvider> provider, int start, int end, int firstLine, int firstColumn = 1)
+        SourceCode(PassRefPtr<SourceProvider> provider, int start, int end, int firstLine)
             : m_provider(provider)
             , m_startChar(start)
             , m_endChar(end)
             , m_firstLine(std::max(firstLine, 1))
-            , m_firstColumn(std::max(firstColumn, 1))
-        {
-        }
-
-        SourceCode(PassRefPtr<SourceProvider> provider, const TextPosition1& startPosition)
-            : m_provider(provider)
-            , m_startChar(0)
-            , m_endChar(m_provider->length())
-            , m_firstLine(startPosition.m_line.oneBasedInt())
-            , m_firstColumn(startPosition.m_column.oneBasedInt())
         {
         }
 
@@ -83,7 +70,6 @@ namespace JSC {
         bool isNull() const { return !m_provider; }
         SourceProvider* provider() const { return m_provider.get(); }
         int firstLine() const { return m_firstLine; }
-        int firstColumn() const { return m_firstColumn; }
         int startOffset() const { return m_startChar; }
         int endOffset() const { return m_endChar; }
         const UChar* data() const { return m_provider->data() + m_startChar; }
@@ -94,7 +80,6 @@ namespace JSC {
         int m_startChar;
         int m_endChar;
         int m_firstLine;
-        int m_firstColumn;
     };
 
     inline SourceCode makeSource(const UString& source, const UString& url = UString(), int firstLine = 1)
diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
index 5ff1d14..bcc445b 100644
--- a/Source/JavaScriptCore/parser/SourceProvider.h
+++ b/Source/JavaScriptCore/parser/SourceProvider.h
@@ -30,32 +30,67 @@
 #define SourceProvider_h
 
 #include "UString.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/UnusedParam.h>
+#include <wtf/text/TextPosition.h>
+
 
 namespace JSC {
 
+    class SourceProviderCache {
+    public:
+        struct Item {};
+
+        SourceProviderCache() : m_contentByteSize(0) {}
+        ~SourceProviderCache() { deleteAllValues(m_map); }
+        
+        unsigned byteSize() const { return m_contentByteSize + sizeof(*this) + m_map.capacity() * sizeof(Item*); } 
+        void add(int sourcePosition, PassOwnPtr<Item> item, unsigned size) { m_map.add(sourcePosition, item.leakPtr()); m_contentByteSize += size; }
+        const Item* get(int sourcePosition) const { return m_map.get(sourcePosition); }
+
+    private:
+        HashMap<int, Item*> m_map;
+        unsigned m_contentByteSize;
+    };
+
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
-        SourceProvider(const UString& url)
+        SourceProvider(const UString& url, SourceProviderCache* cache = 0)
             : m_url(url)
             , m_validated(false)
+            , m_cache(cache ? cache : new SourceProviderCache)
+            , m_cacheOwned(!cache)
+        {
+        }
+        virtual ~SourceProvider()
         {
+            if (m_cacheOwned)
+                delete m_cache;
         }
-        virtual ~SourceProvider() { }
 
         virtual UString getRange(int start, int end) const = 0;
         virtual const UChar* data() const = 0;
         virtual int length() const = 0;
         
         const UString& url() { return m_url; }
+        virtual TextPosition1 startPosition() const { return TextPosition1::minimumPosition(); }
         intptr_t asID() { return reinterpret_cast<intptr_t>(this); }
 
         bool isValid() const { return m_validated; }
         void setValid() { m_validated = true; }
 
+        SourceProviderCache* cache() const { return m_cache; }
+        void notifyCacheSizeChanged(int delta) { if (!m_cacheOwned) cacheSizeChanged(delta); }
+        
     private:
+        virtual void cacheSizeChanged(int delta) { UNUSED_PARAM(delta); }
+
         UString m_url;
         bool m_validated;
+        SourceProviderCache* m_cache;
+        bool m_cacheOwned;
     };
 
     class UStringSourceProvider : public SourceProvider {
diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
index 1b5497a..8823566 100644
--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
@@ -112,6 +112,7 @@ public:
     
     static const bool CreatesAST = false;
     static const bool NeedsFreeVariableInfo = false;
+    static const bool CanUseFunctionCache = true;
 
     int createSourceElements() { return 1; }
     ExpressionType makeFunctionCallNode(int, int, int, int, int) { return CallExpr; }
diff --git a/Source/JavaScriptCore/pcre/pcre_exec.cpp b/Source/JavaScriptCore/pcre/pcre_exec.cpp
index 789f80a..b7018aa 100644
--- a/Source/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/Source/JavaScriptCore/pcre/pcre_exec.cpp
@@ -112,7 +112,9 @@ struct BracketChainNode {
     const UChar* bracketStart;
 };
 
-struct MatchFrame : FastAllocBase {
+struct MatchFrame {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     ReturnLocation returnLocation;
     struct MatchFrame* previousFrame;
     
diff --git a/Source/JavaScriptCore/profiler/CallIdentifier.h b/Source/JavaScriptCore/profiler/CallIdentifier.h
index 76c1470..a9827c0 100644
--- a/Source/JavaScriptCore/profiler/CallIdentifier.h
+++ b/Source/JavaScriptCore/profiler/CallIdentifier.h
@@ -28,13 +28,14 @@
 #define CallIdentifier_h
 
 #include <runtime/UString.h>
-#include "FastAllocBase.h"
 #include <wtf/text/CString.h>
 #include <wtf/text/StringHash.h>
 
 namespace JSC {
 
-    struct CallIdentifier : public FastAllocBase {
+    struct CallIdentifier {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
         UString m_name;
         UString m_url;
         unsigned m_lineNumber;
diff --git a/Source/JavaScriptCore/profiler/Profiler.h b/Source/JavaScriptCore/profiler/Profiler.h
index f9c2ccb..f88746d 100644
--- a/Source/JavaScriptCore/profiler/Profiler.h
+++ b/Source/JavaScriptCore/profiler/Profiler.h
@@ -44,7 +44,8 @@ namespace JSC {
     class UString;
     struct CallIdentifier;    
 
-    class Profiler : public FastAllocBase {
+    class Profiler {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         static Profiler** enabledProfilerReference()
         {
diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
index cd563a2..57e3c20 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
+++ b/Source/JavaScriptCore/runtime/ArgList.h
@@ -25,14 +25,14 @@
 #include "CallFrame.h"
 #include "Register.h"
 #include <wtf/HashSet.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
 
     class MarkStack;
 
-    class MarkedArgumentBuffer : public Noncopyable {
+    class MarkedArgumentBuffer {
+        WTF_MAKE_NONCOPYABLE(MarkedArgumentBuffer);
     private:
         static const unsigned inlineCapacity = 8;
         typedef Vector<Register, inlineCapacity> VectorType;
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 715a2ac..fe900a2 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -33,7 +33,10 @@
 
 namespace JSC {
 
-    struct ArgumentsData : Noncopyable {
+    struct ArgumentsData {
+        WTF_MAKE_NONCOPYABLE(ArgumentsData); WTF_MAKE_FAST_ALLOCATED;
+    public:
+        ArgumentsData() { }
         JSActivation* activation;
 
         unsigned numParameters;
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index ab0c3d4..7615ffc 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -32,6 +32,7 @@
 #include "Lookup.h"
 #include "ObjectPrototype.h"
 #include "Operations.h"
+#include "StringRecursionChecker.h"
 #include <algorithm>
 #include <wtf/Assertions.h>
 #include <wtf/HashSet.h>
@@ -168,15 +169,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
         return throwVMTypeError(exec);
     JSArray* thisObj = asArray(thisValue);
     
-    HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() >= MaxSmallThreadReentryDepth) {
-        if (arrayVisitedElements.size() >= exec->globalData().maxReentryDepth)
-            return throwVMError(exec, createStackOverflowError(exec));
-    }
-
-    bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
-    if (alreadyVisited)
-        return JSValue::encode(jsEmptyString(exec)); // return an empty string, avoiding infinite recursion.
+    StringRecursionChecker checker(exec, thisObj);
+    if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
+        return earlyReturnValue;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned totalSize = length ? length - 1 : 0;
@@ -209,7 +204,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
         if (exec->hadException())
             break;
     }
-    arrayVisitedElements.remove(thisObj);
     if (!totalSize)
         return JSValue::encode(jsEmptyString(exec));
     Vector<UChar> buffer;
@@ -234,15 +228,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
         return throwVMTypeError(exec);
     JSObject* thisObj = asArray(thisValue);
 
-    HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() >= MaxSmallThreadReentryDepth) {
-        if (arrayVisitedElements.size() >= exec->globalData().maxReentryDepth)
-            return throwVMError(exec, createStackOverflowError(exec));
-    }
-
-    bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
-    if (alreadyVisited)
-        return JSValue::encode(jsEmptyString(exec)); // return an empty string, avoding infinite recursion.
+    StringRecursionChecker checker(exec, thisObj);
+    if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
+        return earlyReturnValue;
 
     JSStringBuilder strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
@@ -264,7 +252,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
             strBuffer.append(str);
         }
     }
-    arrayVisitedElements.remove(thisObj);
+
     return JSValue::encode(strBuffer.build(exec));
 }
 
@@ -272,15 +260,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
 
-    HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() >= MaxSmallThreadReentryDepth) {
-        if (arrayVisitedElements.size() >= exec->globalData().maxReentryDepth)
-            return throwVMError(exec, createStackOverflowError(exec));
-    }
-
-    bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
-    if (alreadyVisited)
-        return JSValue::encode(jsEmptyString(exec)); // return an empty string, avoding infinite recursion.
+    StringRecursionChecker checker(exec, thisObj);
+    if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
+        return earlyReturnValue;
 
     JSStringBuilder strBuffer;
 
@@ -335,7 +317,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
         if (!element.isUndefinedOrNull())
             strBuffer.append(element.toString(exec));
     }
-    arrayVisitedElements.remove(thisObj);
+
     return JSValue::encode(strBuffer.build(exec));
 }
 
diff --git a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 74089a5..db2d1d7 100644
--- a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -27,12 +27,12 @@
 #ifndef BatchedTransitionOptimizer_h
 #define BatchedTransitionOptimizer_h
 
-#include <wtf/Noncopyable.h>
 #include "JSObject.h"
 
 namespace JSC {
 
-    class BatchedTransitionOptimizer : public Noncopyable {
+    class BatchedTransitionOptimizer {
+        WTF_MAKE_NONCOPYABLE(BatchedTransitionOptimizer);
     public:
         BatchedTransitionOptimizer(JSObject* object)
             : m_object(object)
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
index 1e22b6a..6587a8f 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -84,7 +84,8 @@
 
 namespace JSC {
 
-    class CommonIdentifiers : public Noncopyable {
+    class CommonIdentifiers {
+        WTF_MAKE_NONCOPYABLE(CommonIdentifiers); WTF_MAKE_FAST_ALLOCATED;
     private:
         CommonIdentifiers(JSGlobalData*);
         friend class JSGlobalData;
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index d18e7d8..d8fc829 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -26,6 +26,7 @@
 #include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
+#include "StringRecursionChecker.h"
 #include "UString.h"
 
 namespace JSC {
@@ -47,6 +48,11 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, No
 EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+
+    StringRecursionChecker checker(exec, thisObj);
+    if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
+        return earlyReturnValue;
+
     JSValue name = thisObj->get(exec, exec->propertyNames().name);
     JSValue message = thisObj->get(exec, exec->propertyNames().message);
 
diff --git a/Source/JavaScriptCore/runtime/Heap.cpp b/Source/JavaScriptCore/runtime/Heap.cpp
index a224ee0..3966324 100644
--- a/Source/JavaScriptCore/runtime/Heap.cpp
+++ b/Source/JavaScriptCore/runtime/Heap.cpp
@@ -41,7 +41,8 @@ Heap::Heap(JSGlobalData* globalData)
     , m_markListSet(0)
     , m_activityCallback(DefaultGCActivityCallback::create(this))
     , m_globalData(globalData)
-    , m_machineStackMarker(&globalData->heap)
+    , m_machineStackMarker(this)
+    , m_markStack(globalData->jsArrayVPtr)
     , m_extraCost(0)
 {
     (*m_activityCallback)();
@@ -93,12 +94,6 @@ void Heap::recordExtraCost(size_t cost)
     if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.size() / 2) {
         JAVASCRIPTCORE_GC_BEGIN();
 
-        // If the last iteration through the heap deallocated blocks, we need
-        // to clean up remaining garbage before marking. Otherwise, the conservative
-        // marking mechanism might follow a pointer to unmapped memory.
-        if (m_markedSpace.didShrink())
-            m_markedSpace.sweep();
-
         markRoots();
 
         JAVASCRIPTCORE_GC_MARKED();
@@ -152,9 +147,9 @@ void* Heap::allocate(size_t s)
     return result;
 }
 
-void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
+void Heap::markConservatively(ConservativeSet& conservativeSet, void* start, void* end)
 {
-    m_markedSpace.markConservatively(markStack, start, end);
+    m_markedSpace.markConservatively(conservativeSet, start, end);
 }
 
 void Heap::updateWeakGCHandles()
@@ -212,10 +207,8 @@ bool Heap::unprotect(JSValue k)
 void Heap::markProtectedObjects(MarkStack& markStack)
 {
     ProtectCountSet::iterator end = m_protectedValues.end();
-    for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
+    for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         markStack.append(it->first);
-        markStack.drain();
-    }
 }
 
 void Heap::pushTempSortVector(Vector<ValueStringPair>* tempVector)
@@ -238,10 +231,10 @@ void Heap::markTempSortVectors(MarkStack& markStack)
         Vector<ValueStringPair>* tempSortingVector = *it;
 
         Vector<ValueStringPair>::iterator vectorEnd = tempSortingVector->end();
-        for (Vector<ValueStringPair>::iterator vectorIt = tempSortingVector->begin(); vectorIt != vectorEnd; ++vectorIt)
+        for (Vector<ValueStringPair>::iterator vectorIt = tempSortingVector->begin(); vectorIt != vectorEnd; ++vectorIt) {
             if (vectorIt->first)
                 markStack.append(vectorIt->first);
-        markStack.drain();
+        }
     }
 }
     
@@ -260,20 +253,27 @@ void Heap::markRoots()
 
     m_operationInProgress = Collection;
 
-    MarkStack& markStack = m_globalData->markStack;
+    // We gather the conservative set before clearing mark bits, because
+    // conservative gathering uses the mark bits from our last mark pass to
+    // determine whether a reference is valid.
+    ConservativeSet conservativeSet;
+    m_machineStackMarker.markMachineStackConservatively(conservativeSet);
+    m_globalData->interpreter->registerFile().markCallFrames(conservativeSet, this);
 
     // Reset mark bits.
     m_markedSpace.clearMarkBits();
 
-    // Mark stack roots.
-    m_machineStackMarker.markMachineStackConservatively(markStack);
-    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
+    MarkStack& markStack = m_markStack;
+    conservativeSet.mark(markStack);
+    markStack.drain();
 
     // Mark explicitly registered roots.
     markProtectedObjects(markStack);
+    markStack.drain();
     
     // Mark temporary vector for Array sorting
     markTempSortVectors(markStack);
+    markStack.drain();
 
     // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
@@ -282,6 +282,7 @@ void Heap::markRoots()
         markStack.append(m_globalData->exception);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
+    markStack.drain();
 
     // Mark the small strings cache last, since it will clear itself if nothing
     // else has marked it.
@@ -392,12 +393,6 @@ void Heap::collectAllGarbage()
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     JAVASCRIPTCORE_GC_BEGIN();
 
-    // If the last iteration through the heap deallocated blocks, we need
-    // to clean up remaining garbage before marking. Otherwise, the conservative
-    // marking mechanism might follow a pointer to unmapped memory.
-    if (m_markedSpace.didShrink())
-        m_markedSpace.sweep();
-
     markRoots();
 
     JAVASCRIPTCORE_GC_MARKED();
diff --git a/Source/JavaScriptCore/runtime/Heap.h b/Source/JavaScriptCore/runtime/Heap.h
index 243bba3..f7f4deb 100644
--- a/Source/JavaScriptCore/runtime/Heap.h
+++ b/Source/JavaScriptCore/runtime/Heap.h
@@ -22,6 +22,7 @@
 #ifndef Heap_h
 #define Heap_h
 
+#include "MarkStack.h"
 #include "MarkedSpace.h"
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
@@ -45,7 +46,8 @@ namespace JSC {
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
 
-    class Heap : public Noncopyable {
+    class Heap {
+        WTF_MAKE_NONCOPYABLE(Heap);
     public:
         void destroy();
 
@@ -86,7 +88,7 @@ namespace JSC {
 
         WeakGCHandle* addWeakGCHandle(JSCell*);
 
-        void markConservatively(MarkStack&, void* start, void* end);
+        void markConservatively(ConservativeSet&, void* start, void* end);
 
         void pushTempSortVector(WTF::Vector<ValueStringPair>*);
         void popTempSortVector(WTF::Vector<ValueStringPair>*);        
@@ -130,6 +132,7 @@ namespace JSC {
         JSGlobalData* m_globalData;
         
         MachineStackMarker m_machineStackMarker;
+        MarkStack m_markStack;
         
         size_t m_extraCost;
     };
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 1147858..428403d 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -53,6 +53,7 @@ void JSActivation::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
+    // No need to mark our registers if they're still in the RegisterFile.
     Register* registerArray = d()->registerArray.get();
     if (!registerArray)
         return;
@@ -202,14 +203,16 @@ JSValue JSActivation::argumentsGetter(ExecState*, JSValue slotBase, const Identi
     JSActivation* activation = asActivation(slotBase);
     CallFrame* callFrame = CallFrame::create(activation->d()->registers);
     int argumentsRegister = activation->d()->functionExecutable->generatedBytecode().argumentsRegister();
-    if (!callFrame->uncheckedR(argumentsRegister).jsValue()) {
-        JSValue arguments = JSValue(new (callFrame) Arguments(callFrame));
-        callFrame->uncheckedR(argumentsRegister) = arguments;
-        callFrame->uncheckedR(unmodifiedArgumentsRegister(argumentsRegister)) = arguments;
-    }
+    if (JSValue arguments = callFrame->uncheckedR(argumentsRegister).jsValue())
+        return arguments;
+    int realArgumentsRegister = unmodifiedArgumentsRegister(argumentsRegister);
 
-    ASSERT(callFrame->uncheckedR(argumentsRegister).jsValue().inherits(&Arguments::info));
-    return callFrame->uncheckedR(argumentsRegister).jsValue();
+    JSValue arguments = JSValue(new (callFrame) Arguments(callFrame));
+    callFrame->uncheckedR(argumentsRegister) = arguments;
+    callFrame->uncheckedR(realArgumentsRegister) = arguments;
+    
+    ASSERT(callFrame->uncheckedR(realArgumentsRegister).jsValue().inherits(&Arguments::info));
+    return callFrame->uncheckedR(realArgumentsRegister).jsValue();
 }
 
 // These two functions serve the purpose of isolating the common case from a
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index f20a9a4..3928c82 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -143,7 +143,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , head(0)
     , dynamicGlobalObject(0)
     , firstStringifierToMark(0)
-    , markStack(jsArrayVPtr)
     , cachedUTCOffset(NaN)
     , maxReentryDepth(threadStackType == ThreadStackTypeSmall ? MaxSmallThreadReentryDepth : MaxLargeThreadReentryDepth)
     , m_regExpCache(new RegExpCache(this))
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index a24732a..31f41e9 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -35,7 +35,6 @@
 #include "ExecutableAllocator.h"
 #include "JITStubs.h"
 #include "JSValue.h"
-#include "MarkStack.h"
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "Terminator.h"
@@ -214,12 +213,10 @@ namespace JSC {
         JSGlobalObject* head;
         JSGlobalObject* dynamicGlobalObject;
 
-        HashSet<JSObject*> arrayVisitedElements;
+        HashSet<JSObject*> stringRecursionCheckVisitedObjects;
 
         Stringifier* firstStringifierToMark;
 
-        MarkStack markStack;
-
         double cachedUTCOffset;
         DSTOffsetCache dstOffsetCache;
         
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 408aea7..9b67dbb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -349,10 +349,6 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->markAggregate(markStack);
 
-    RegisterFile& registerFile = globalData().interpreter->registerFile();
-    if (registerFile.globalObject() == this)
-        registerFile.markGlobals(markStack, &globalData().heap);
-
     markIfNeeded(markStack, d()->regExpConstructor);
     markIfNeeded(markStack, d()->errorConstructor);
     markIfNeeded(markStack, d()->evalErrorConstructor);
@@ -397,12 +393,16 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     // No need to mark the other structures, because their prototypes are all
     // guaranteed to be referenced elsewhere.
 
-    Register* registerArray = d()->registerArray.get();
-    if (!registerArray)
-        return;
-
-    size_t size = d()->registerArraySize;
-    markStack.appendValues(reinterpret_cast<JSValue*>(registerArray), size);
+    if (d()->registerArray) {
+        // Outside the execution of global code, when our variables are torn off,
+        // we can mark the torn-off array.
+        markStack.appendValues(d()->registerArray.get(), d()->registerArraySize);
+    } else if (d()->registers) {
+        // During execution of global code, when our variables are in the register file,
+        // the symbol table tells us how many variables there are, and registers
+        // points to where they end, and the registers used for execution begin.
+        markStack.appendValues(d()->registers - symbolTable().size(), symbolTable().size());
+    }
 }
 
 ExecState* JSGlobalObject::globalExec()
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index a22b0aa..24bc2f8 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -465,7 +465,8 @@ namespace JSC {
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
     }
 
-    class DynamicGlobalObjectScope : public Noncopyable {
+    class DynamicGlobalObjectScope {
+        WTF_MAKE_NONCOPYABLE(DynamicGlobalObjectScope);
     public:
         DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject);
 
diff --git a/Source/JavaScriptCore/runtime/JSLock.h b/Source/JavaScriptCore/runtime/JSLock.h
index 05b388c..7b07b4f 100644
--- a/Source/JavaScriptCore/runtime/JSLock.h
+++ b/Source/JavaScriptCore/runtime/JSLock.h
@@ -53,7 +53,8 @@ namespace JSC {
 
     enum JSLockBehavior { SilenceAssertionsOnly, LockForReal };
 
-    class JSLock : public Noncopyable {
+    class JSLock {
+        WTF_MAKE_NONCOPYABLE(JSLock);
     public:
         JSLock(ExecState*);
         JSLock(JSGlobalData*);
@@ -89,7 +90,8 @@ namespace JSC {
 
         JSLockBehavior m_lockBehavior;
 
-        class DropAllLocks : public Noncopyable {
+        class DropAllLocks {
+            WTF_MAKE_NONCOPYABLE(DropAllLocks);
         public:
             DropAllLocks(ExecState* exec);
             DropAllLocks(JSLockBehavior);
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 9e63027..df4be52 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -70,7 +70,8 @@ private:
     mutable JSValue m_value;
 };
 
-class Stringifier : public Noncopyable {
+class Stringifier {
+    WTF_MAKE_NONCOPYABLE(Stringifier);
 public:
     Stringifier(ExecState*, JSValue replacer, JSValue space);
     ~Stringifier();
diff --git a/Source/JavaScriptCore/runtime/Lookup.h b/Source/JavaScriptCore/runtime/Lookup.h
index 9bc81d4..0d6d98f 100644
--- a/Source/JavaScriptCore/runtime/Lookup.h
+++ b/Source/JavaScriptCore/runtime/Lookup.h
@@ -53,7 +53,8 @@ namespace JSC {
     typedef PropertySlot::GetValueFunc GetFunction;
     typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
-    class HashEntry : public FastAllocBase {
+    class HashEntry {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         void initialize(StringImpl* key, unsigned char attributes, intptr_t v1, intptr_t v2
 #if ENABLE(JIT)
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
index b4a1936..e52f402 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
@@ -194,10 +194,9 @@ void MachineStackMarker::unregisterThread()
 
 #endif
 
-void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(MarkStack& markStack)
+void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(ConservativeSet& conservativeSet)
 {
-    m_heap->markConservatively(markStack, m_heap->globalData()->stack().current(), m_heap->globalData()->stack().origin());
-    markStack.drain();
+    m_heap->markConservatively(conservativeSet, m_heap->globalData()->stack().current(), m_heap->globalData()->stack().origin());
 }
 
 #if COMPILER(GCC)
@@ -206,7 +205,7 @@ void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(Ma
 #define REGISTER_BUFFER_ALIGNMENT
 #endif
 
-void MachineStackMarker::markCurrentThreadConservatively(MarkStack& markStack)
+void MachineStackMarker::markCurrentThreadConservatively(ConservativeSet& conservativeSet)
 {
     // setjmp forces volatile registers onto the stack
     jmp_buf registers REGISTER_BUFFER_ALIGNMENT;
@@ -219,7 +218,7 @@ void MachineStackMarker::markCurrentThreadConservatively(MarkStack& markStack)
 #pragma warning(pop)
 #endif
 
-    markCurrentThreadConservativelyInternal(markStack);
+    markCurrentThreadConservativelyInternal(conservativeSet);
 }
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -351,7 +350,7 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 #endif
 }
 
-void MachineStackMarker::markOtherThreadConservatively(MarkStack& markStack, Thread* thread)
+void MachineStackMarker::markOtherThreadConservatively(ConservativeSet& conservativeSet, Thread* thread)
 {
     suspendThread(thread->platformThread);
 
@@ -359,21 +358,19 @@ void MachineStackMarker::markOtherThreadConservatively(MarkStack& markStack, Thr
     size_t regSize = getPlatformThreadRegisters(thread->platformThread, regs);
 
     // mark the thread's registers
-    m_heap->markConservatively(markStack, static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
-    markStack.drain();
+    m_heap->markConservatively(conservativeSet, static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
 
     void* stackPointer = otherThreadStackPointer(regs);
-    m_heap->markConservatively(markStack, stackPointer, thread->stackBase);
-    markStack.drain();
+    m_heap->markConservatively(conservativeSet, stackPointer, thread->stackBase);
 
     resumeThread(thread->platformThread);
 }
 
 #endif
 
-void MachineStackMarker::markMachineStackConservatively(MarkStack& markStack)
+void MachineStackMarker::markMachineStackConservatively(ConservativeSet& conservativeSet)
 {
-    markCurrentThreadConservatively(markStack);
+    markCurrentThreadConservatively(conservativeSet);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
@@ -391,7 +388,7 @@ void MachineStackMarker::markMachineStackConservatively(MarkStack& markStack)
         // and since this is a shared heap, they are real locks.
         for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
             if (!pthread_equal(thread->posixThread, pthread_self()))
-                markOtherThreadConservatively(markStack, thread);
+                markOtherThreadConservatively(conservativeSet, thread);
         }
 #ifndef NDEBUG
         fastMallocAllow();
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.h b/Source/JavaScriptCore/runtime/MachineStackMarker.h
index e80fe05..8afdb46 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.h
+++ b/Source/JavaScriptCore/runtime/MachineStackMarker.h
@@ -32,14 +32,15 @@
 namespace JSC {
 
     class Heap;
-    class MarkStack;
+    class ConservativeSet;
 
-    class MachineStackMarker : public Noncopyable {
+    class MachineStackMarker {
+        WTF_MAKE_NONCOPYABLE(MachineStackMarker);
     public:
         MachineStackMarker(Heap*);
         ~MachineStackMarker();
 
-        void markMachineStackConservatively(MarkStack&);
+        void markMachineStackConservatively(ConservativeSet&);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
@@ -47,8 +48,8 @@ namespace JSC {
 #endif
 
     private:
-        void markCurrentThreadConservatively(MarkStack&);
-        void markCurrentThreadConservativelyInternal(MarkStack&);
+        void markCurrentThreadConservatively(ConservativeSet&);
+        void markCurrentThreadConservativelyInternal(ConservativeSet&);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         class Thread;
@@ -56,7 +57,7 @@ namespace JSC {
         static void unregisterThread(void*);
 
         void unregisterThread();
-        void markOtherThreadConservatively(MarkStack&, Thread*);
+        void markOtherThreadConservatively(ConservativeSet&, Thread*);
 #endif
 
         Heap* m_heap;
diff --git a/Source/JavaScriptCore/runtime/MarkStack.h b/Source/JavaScriptCore/runtime/MarkStack.h
index 7bccadf..7946e65 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.h
+++ b/Source/JavaScriptCore/runtime/MarkStack.h
@@ -27,6 +27,7 @@
 #define MarkStack_h
 
 #include "JSValue.h"
+#include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OSAllocator.h>
 
@@ -37,7 +38,8 @@ namespace JSC {
     
     enum MarkSetProperties { MayContainNullValues, NoNullValues };
     
-    class MarkStack : Noncopyable {
+    class MarkStack {
+        WTF_MAKE_NONCOPYABLE(MarkStack);
     public:
         MarkStack(void* jsArrayVPtr)
             : m_jsArrayVPtr(jsArrayVPtr)
@@ -185,6 +187,20 @@ namespace JSC {
         bool m_isDraining;
 #endif
     };
+    
+    class ConservativeSet {
+    public:
+        void add(JSCell* cell) { m_set.add(cell); }
+        void mark(MarkStack& markStack)
+        {
+            HashSet<JSCell*>::iterator end = m_set.end();
+            for (HashSet<JSCell*>::iterator it = m_set.begin(); it != end; ++it)
+                markStack.append(*it);
+        }
+
+    private:
+        HashSet<JSCell*> m_set;
+    };
 }
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.cpp b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
index 4bc3c18..036c8f0 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
@@ -108,8 +108,6 @@ NEVER_INLINE CollectorBlock* MarkedSpace::allocateBlock()
 
 NEVER_INLINE void MarkedSpace::freeBlock(size_t block)
 {
-    m_heap.didShrink = true;
-
     ObjectIterator it(m_heap, block);
     ObjectIterator end(m_heap, block + 1);
     for ( ; it != end; ++it)
@@ -162,8 +160,6 @@ void* MarkedSpace::allocate(size_t s)
 
 void MarkedSpace::resizeBlocks()
 {
-    m_heap.didShrink = false;
-
     size_t usedCellCount = markedCells();
     size_t minCellCount = usedCellCount + max(ALLOCATIONS_PER_COLLECTION, usedCellCount);
     size_t minBlockCount = (minCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
@@ -222,7 +218,7 @@ static inline bool isPossibleCell(void* p)
     return isCellAligned(p) && p;
 }
 
-void MarkedSpace::markConservatively(MarkStack& markStack, void* start, void* end)
+void MarkedSpace::markConservatively(ConservativeSet& conservativeSet, void* start, void* end)
 {
 #if OS(WINCE)
     if (start > end) {
@@ -244,7 +240,6 @@ void MarkedSpace::markConservatively(MarkStack& markStack, void* start, void* en
     while (p != e) {
         char* x = *p++;
         if (isPossibleCell(x)) {
-            size_t usedBlocks;
             uintptr_t xAsBits = reinterpret_cast<uintptr_t>(x);
             xAsBits &= CELL_ALIGN_MASK;
 
@@ -254,11 +249,30 @@ void MarkedSpace::markConservatively(MarkStack& markStack, void* start, void* en
                 continue;
 
             CollectorBlock* blockAddr = reinterpret_cast<CollectorBlock*>(xAsBits - offset);
-            usedBlocks = m_heap.usedBlocks;
+            size_t usedBlocks = m_heap.usedBlocks;
             for (size_t block = 0; block < usedBlocks; block++) {
                 if (m_heap.collectorBlock(block) != blockAddr)
                     continue;
-                markStack.append(reinterpret_cast<JSCell*>(xAsBits));
+
+                // x is a pointer into the heap. Now, verify that the cell it
+                // points to is live. (If the cell is dead, we must not mark it,
+                // since that would revive it in a zombie state.)
+                if (block < m_heap.nextBlock) {
+                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
+                    break;
+                }
+                
+                size_t cellOffset = offset / CELL_SIZE;
+                
+                if (block == m_heap.nextBlock && cellOffset < m_heap.nextCell) {
+                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
+                    break;
+                }
+                
+                if (blockAddr->marked.get(cellOffset)) {
+                    conservativeSet.add(reinterpret_cast<JSCell*>(xAsBits));
+                    break;
+                }
             }
         }
     }
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.h b/Source/JavaScriptCore/runtime/MarkedSpace.h
index 78f918c..af312b5 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.h
+++ b/Source/JavaScriptCore/runtime/MarkedSpace.h
@@ -55,15 +55,14 @@ namespace JSC {
         size_t numBlocks;
         size_t usedBlocks;
 
-        bool didShrink;
-
         CollectorBlock* collectorBlock(size_t index) const
         {
             return static_cast<CollectorBlock*>(blocks[index].base());
         }
     };
 
-    class MarkedSpace : public Noncopyable {
+    class MarkedSpace {
+        WTF_MAKE_NONCOPYABLE(MarkedSpace);
     public:
         MarkedSpace(JSGlobalData*);
         void destroy(ProtectCountSet&);
@@ -86,7 +85,7 @@ namespace JSC {
 
         WeakGCHandle* addWeakGCHandle(JSCell*);
 
-        void markConservatively(MarkStack&, void* start, void* end);
+        void markConservatively(ConservativeSet&, void* start, void* end);
 
         static bool isNumber(JSCell*);
         
@@ -114,8 +113,6 @@ namespace JSC {
 
         void markRoots();
 
-        bool didShrink() { return m_heap.didShrink; }
-        
     private:
         CollectorHeap m_heap;
         JSGlobalData* m_globalData;
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index 58abde5..1714bd3 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -31,7 +31,9 @@ namespace JSC {
     class RegExpPrototype;
     struct RegExpConstructorPrivate;
 
-    struct RegExpConstructorPrivate : FastAllocBase {
+    struct RegExpConstructorPrivate {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
         // Global search cache / settings
         RegExpConstructorPrivate()
             : lastNumSubPatterns(0)
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 7fda5b1..b969e38 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -128,17 +128,6 @@ JSValue RegExpObject::exec(ExecState* exec)
     return jsNull();
 }
 
-static EncodedJSValue JSC_HOST_CALL callRegExpObject(ExecState* exec)
-{
-    return JSValue::encode(asRegExpObject(exec->callee())->exec(exec));
-}
-
-CallType RegExpObject::getCallData(CallData& callData)
-{
-    callData.native.function = callRegExpObject;
-    return CallTypeHost;
-}
-
 // Shared implementation used by test and exec.
 bool RegExpObject::match(ExecState* exec)
 {
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index 19de929..99c84da 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -58,9 +58,9 @@ namespace JSC {
     private:
         bool match(ExecState*);
 
-        virtual CallType getCallData(CallData&);
-
-        struct RegExpObjectData : FastAllocBase {
+        struct RegExpObjectData {
+            WTF_MAKE_FAST_ALLOCATED;
+        public:
             RegExpObjectData(NonNullPassRefPtr<RegExp> regExp, double lastIndex)
                 : regExp(regExp)
                 , lastIndex(lastIndex)
@@ -70,7 +70,9 @@ namespace JSC {
             RefPtr<RegExp> regExp;
             double lastIndex;
         };
-
+#if PLATFORM(WIN)
+        friend void WTF::deleteOwnedPtr<RegExpObjectData>(RegExpObjectData*);
+#endif
         OwnPtr<RegExpObjectData> d;
     };
 
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 04bcc3b..a7c447d 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -34,6 +34,7 @@
 #include "RegExpObject.h"
 #include "RegExp.h"
 #include "RegExpCache.h"
+#include "StringRecursionChecker.h"
 #include "UStringConcatenate.h"
 
 namespace JSC {
@@ -111,15 +112,21 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
         return throwVMTypeError(exec);
     }
 
+    RegExpObject* thisObject = asRegExpObject(thisValue);
+
+    StringRecursionChecker checker(exec, thisObject);
+    if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
+        return earlyReturnValue;
+
     char postfix[5] = { '/', 0, 0, 0, 0 };
     int index = 1;
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
+    if (thisObject->get(exec, exec->propertyNames().global).toBoolean(exec))
         postfix[index++] = 'g';
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
+    if (thisObject->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
         postfix[index++] = 'i';
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
+    if (thisObject->get(exec, exec->propertyNames().multiline).toBoolean(exec))
         postfix[index] = 'm';
-    UString source = asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
+    UString source = thisObject->get(exec, exec->propertyNames().source).toString(exec);
     // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
     return JSValue::encode(jsMakeNontrivialString(exec, "/", source.length() ? source : UString("(?:)"), postfix));
 }
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index 0b15b67..b104e75 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -21,7 +21,7 @@
 #ifndef ScopeChain_h
 #define ScopeChain_h
 
-#include "FastAllocBase.h"
+#include <wtf/FastAllocBase.h>
 
 namespace JSC {
 
@@ -31,7 +31,8 @@ namespace JSC {
     class MarkStack;
     class ScopeChainIterator;
     
-    class ScopeChainNode : public FastAllocBase {
+    class ScopeChainNode {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
             : next(next)
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index f358727..5614932 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -40,7 +40,8 @@ static inline bool isMarked(JSString* string)
     return string && Heap::isCellMarked(string);
 }
 
-class SmallStringsStorage : public Noncopyable {
+class SmallStringsStorage {
+    WTF_MAKE_NONCOPYABLE(SmallStringsStorage); WTF_MAKE_FAST_ALLOCATED;
 public:
     SmallStringsStorage();
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index d1ebfb1..ac84fe8 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -37,7 +37,8 @@ namespace JSC {
     class MarkStack;
     class SmallStringsStorage;
 
-    class SmallStrings : public Noncopyable {
+    class SmallStrings {
+        WTF_MAKE_NONCOPYABLE(SmallStrings); WTF_MAKE_FAST_ALLOCATED;
     public:
         SmallStrings();
         ~SmallStrings();
diff --git a/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp b/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
new file mode 100644
index 0000000..4e74735
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
@@ -0,0 +1,38 @@
+/*
+ *  Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "StringRecursionChecker.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+
+namespace JSC {
+
+EncodedJSValue StringRecursionChecker::throwStackOverflowError()
+{
+    return throwVMError(m_exec, createStackOverflowError(m_exec));
+}
+
+EncodedJSValue StringRecursionChecker::emptyString()
+{
+    return JSValue::encode(jsEmptyString(m_exec));
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/StringRecursionChecker.h b/Source/JavaScriptCore/runtime/StringRecursionChecker.h
new file mode 100644
index 0000000..314f14e
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/StringRecursionChecker.h
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef StringRecursionChecker_h
+#define StringRecursionChecker_h
+
+#include "Interpreter.h"
+
+namespace JSC {
+
+class StringRecursionChecker {
+    WTF_MAKE_NONCOPYABLE(StringRecursionChecker);
+
+public:
+    StringRecursionChecker(ExecState*, JSObject* thisObject);
+    ~StringRecursionChecker();
+
+    EncodedJSValue earlyReturnValue() const; // 0 if everything is OK, value to return for failure cases
+
+private:
+    EncodedJSValue throwStackOverflowError();
+    EncodedJSValue emptyString();
+    EncodedJSValue performCheck();
+
+    ExecState* m_exec;
+    JSObject* m_thisObject;
+    EncodedJSValue m_earlyReturnValue;
+};
+
+inline EncodedJSValue StringRecursionChecker::performCheck()
+{
+    int size = m_exec->globalData().stringRecursionCheckVisitedObjects.size();
+    if (size >= MaxSmallThreadReentryDepth && size >= m_exec->globalData().maxReentryDepth)
+        return throwStackOverflowError();
+    bool alreadyVisited = !m_exec->globalData().stringRecursionCheckVisitedObjects.add(m_thisObject).second;
+    if (alreadyVisited)
+        return emptyString(); // Return empty string to avoid infinite recursion.
+    return 0; // Indicate success.
+}
+
+inline StringRecursionChecker::StringRecursionChecker(ExecState* exec, JSObject* thisObject)
+    : m_exec(exec)
+    , m_thisObject(thisObject)
+    , m_earlyReturnValue(performCheck())
+{
+}
+
+inline EncodedJSValue StringRecursionChecker::earlyReturnValue() const
+{
+    return m_earlyReturnValue;
+}
+
+inline StringRecursionChecker::~StringRecursionChecker()
+{
+    if (m_earlyReturnValue)
+        return;
+    ASSERT(m_exec->globalData().stringRecursionCheckVisitedObjects.contains(m_thisObject));
+    m_exec->globalData().stringRecursionCheckVisitedObjects.remove(m_thisObject);
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 1b1636d..2635501 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -122,6 +122,7 @@ namespace JSC {
     typedef HashMap<RefPtr<StringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<StringImpl> >, SymbolTableIndexHashTraits> SymbolTable;
 
     class SharedSymbolTable : public SymbolTable, public RefCounted<SharedSymbolTable> {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         static PassRefPtr<SharedSymbolTable> create() { return adoptRef(new SharedSymbolTable); }
     private:
diff --git a/Source/JavaScriptCore/runtime/WeakGCMap.h b/Source/JavaScriptCore/runtime/WeakGCMap.h
index 2d4e59d..316794f 100644
--- a/Source/JavaScriptCore/runtime/WeakGCMap.h
+++ b/Source/JavaScriptCore/runtime/WeakGCMap.h
@@ -35,7 +35,8 @@ class JSCell;
 
 // A HashMap whose get() function returns emptyValue() for cells awaiting destruction.
 template<typename KeyType, typename MappedType>
-class WeakGCMap : public FastAllocBase {
+class WeakGCMap {
+    WTF_MAKE_FAST_ALLOCATED;
     /*
     Invariants:
         * A value enters the WeakGCMap marked. (Guaranteed by set().)
diff --git a/Source/JavaScriptCore/runtime/WeakGCPtr.h b/Source/JavaScriptCore/runtime/WeakGCPtr.h
index 6cc75a5..4946ee7 100644
--- a/Source/JavaScriptCore/runtime/WeakGCPtr.h
+++ b/Source/JavaScriptCore/runtime/WeakGCPtr.h
@@ -28,12 +28,12 @@
 
 #include "Heap.h"
 #include "GCHandle.h"
-#include <wtf/Noncopyable.h>
 
 namespace JSC {
 
 // A smart pointer whose get() function returns 0 for cells awaiting destruction.
-template <typename T> class WeakGCPtr : Noncopyable {
+template <typename T> class WeakGCPtr {
+    WTF_MAKE_NONCOPYABLE(WeakGCPtr);
 public:
     WeakGCPtr()
         : m_ptr(0)
diff --git a/Source/JavaScriptCore/tests/mozilla/expected.html b/Source/JavaScriptCore/tests/mozilla/expected.html
index 785378d..7dd958b 100644
--- a/Source/JavaScriptCore/tests/mozilla/expected.html
+++ b/Source/JavaScriptCore/tests/mozilla/expected.html
@@ -7,11 +7,11 @@
 <p class='results_summary'>
 Test List: All tests<br>
 Skip List: ecma/Date/15.9.2.1.js, ecma/Date/15.9.2.2-1.js, ecma/Date/15.9.2.2-2.js, ecma/Date/15.9.2.2-3.js, ecma/Date/15.9.2.2-4.js, ecma/Date/15.9.2.2-5.js, ecma/Date/15.9.2.2-6.js, ecma_3/Date/15.9.5.7.js<br>
-1127 test(s) selected, 1119 test(s) completed, 46 failures reported (4.11% failed)<br>
-Engine command line: "/home/stampho/webkit/WebKitBuild/Release/JavaScriptCore/jsc" <br>
-OS type: Linux euclides 2.6.35-gentoo-r5 #1 SMP Tue Aug 31 13:19:25 CEST 2010 i686 Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz GenuineIntel GNU/Linux<br>
-Testcase execution time: 16 seconds.<br>
-Tests completed on Fri Oct 15 00:29:31 2010.<br><br>
+1127 test(s) selected, 1119 test(s) completed, 51 failures reported (4.55% failed)<br>
+Engine command line: "/Volumes/BigData/git/WebKit/WebKitBuild/Debug/jsc" <br>
+OS type: Darwin 10.6.0 Darwin Kernel Version 10.6.0: Wed Nov 10 18:13:17 PST 2010; root:xnu-1504.9.26~3/RELEASE_I386 i386<br>
+Testcase execution time: 1 minutes, 3 seconds.<br>
+Tests completed on Wed Jan 19 13:26:57 2011.<br><br>
 [ <a href='#fail_detail'>Failure Details</a> | <a href='#retest_list'>Retest List</a> | <a href='menu.html'>Test Selection Page</a> ]<br>
 <hr>
 <a name='fail_detail'></a>
@@ -29,53 +29,67 @@ Failure messages were:<br>
 Failure messages were:<br>
 eval("function f(){}function g(){}") (threw no exception thrown = fail FAILED! expected: pass<br>
 </tt><br>
-<a name='failure3'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/FunExpr/fe-001.js'>ecma_3/FunExpr/fe-001.js</a> failed</b> <br>
+<a name='failure3'></a><dd><b>Testcase <a target='other_window' href='./ecma_2/RegExp/regress-001.js'>ecma_2/RegExp/regress-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=2157' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=2157</a><br>
  [ <a href='#failure2'>Previous Failure</a> | <a href='#failure4'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+RegExp/hex-001.js JS regexp anchoring on empty match bug<br>
+BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=2157<br>
+</tt><br>
+<a name='failure4'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/FunExpr/fe-001.js'>ecma_3/FunExpr/fe-001.js</a> failed</b> <br>
+ [ <a href='#failure3'>Previous Failure</a> | <a href='#failure5'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Function Expression Statements basic test.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Both functions were defined.<br>
 FAILED!: [reported from test()] Expected value '1', Actual value '0'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure4'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Statements/regress-194364.js'>ecma_3/Statements/regress-194364.js</a> failed</b> <br>
- [ <a href='#failure3'>Previous Failure</a> | <a href='#failure5'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure5'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Statements/regress-194364.js'>ecma_3/Statements/regress-194364.js</a> failed</b> <br>
+ [ <a href='#failure4'>Previous Failure</a> | <a href='#failure6'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure5'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
- [ <a href='#failure4'>Previous Failure</a> | <a href='#failure6'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure6'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
+ [ <a href='#failure5'>Previous Failure</a> | <a href='#failure7'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Unicode format-control character (Category Cf) test.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Unicode format-control character test (Category Cf.)<br>
 FAILED!: [reported from test()] Expected value 'no error', Actual value 'no‎ error'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure6'></a><dd><b>Testcase <a target='other_window' href='./js1_2/Objects/toString-001.js'>js1_2/Objects/toString-001.js</a> failed</b> <br>
- [ <a href='#failure5'>Previous Failure</a> | <a href='#failure7'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt><br>
-Failure messages were:<br>
-var o = new Object(); o.toString() = [object Object] FAILED! expected: {}<br>
-o = {}; o.toString() = [object Object] FAILED! expected: {}<br>
-o = { name:"object", length:0, value:"hello" }; o.toString() = false FAILED! expected: true<br>
-</tt><br>
-<a name='failure7'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/Function_object.js'>js1_2/function/Function_object.js</a> failed</b> <br>
+<a name='failure7'></a><dd><b>Testcase <a target='other_window' href='./js1_2/Objects/toString-001.js'>js1_2/Objects/toString-001.js</a> failed</b> <br>
  [ <a href='#failure6'>Previous Failure</a> | <a href='#failure8'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+JS1_2 Object.toString()<br>
+</tt><br>
+<a name='failure8'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/Function_object.js'>js1_2/function/Function_object.js</a> failed</b> <br>
+ [ <a href='#failure7'>Previous Failure</a> | <a href='#failure9'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 f.arity = undefined FAILED! expected: 3<br>
 } FAILED! expected: <br>
 </tt><br>
-<a name='failure8'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/function-001-n.js'>js1_2/function/function-001-n.js</a> failed</b> <br>
- [ <a href='#failure7'>Previous Failure</a> | <a href='#failure9'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure9'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/function-001-n.js'>js1_2/function/function-001-n.js</a> failed</b> <br>
+ [ <a href='#failure8'>Previous Failure</a> | <a href='#failure10'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure9'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-1.js'>js1_2/function/tostring-1.js</a> failed</b> <br>
- [ <a href='#failure8'>Previous Failure</a> | <a href='#failure10'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/regexparg-1.js'>js1_2/function/regexparg-1.js</a> failed</b> <br>
+ [ <a href='#failure9'>Previous Failure</a> | <a href='#failure11'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+JS_1.2 The variable statment<br>
+</tt><br>
+<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-1.js'>js1_2/function/tostring-1.js</a> failed</b> <br>
+ [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 } FAILED! expected: <br>
@@ -84,8 +98,8 @@ Failure messages were:<br>
 } FAILED! expected: <br>
 } FAILED! expected: <br>
 </tt><br>
-<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-2.js'>js1_2/function/tostring-2.js</a> failed</b> <br>
- [ <a href='#failure9'>Previous Failure</a> | <a href='#failure11'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-2.js'>js1_2/function/tostring-2.js</a> failed</b> <br>
+ [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 } FAILED! expected: <br>
@@ -98,22 +112,22 @@ Failure messages were:<br>
 } FAILED! expected: <br>
 } FAILED! expected: <br>
 </tt><br>
-<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
- [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
+ [ <a href='#failure12'>Previous Failure</a> | <a href='#failure14'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 (new String('x') == 'x')                  = true FAILED! expected: false<br>
 ('x' == new String('x'))                  = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
- [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
+ [ <a href='#failure13'>Previous Failure</a> | <a href='#failure15'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 re=/x./g; re.lastIndex=4; re.exec('xyabcdxa') = xa FAILED! expected: ["xa"]<br>
 re.exec('xyabcdef') = xy FAILED! expected: ["xy"]<br>
 </tt><br>
-<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline.js'>js1_2/regexp/RegExp_multiline.js</a> failed</b> <br>
- [ <a href='#failure12'>Previous Failure</a> | <a href='#failure14'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline.js'>js1_2/regexp/RegExp_multiline.js</a> failed</b> <br>
+ [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 (multiline == true) '123\n456'.match(/^4../) = null FAILED! expected: 456<br>
@@ -122,8 +136,8 @@ Failure messages were:<br>
 (multiline == true) 'a11\na22\na23\na24'.match(/a..$/g) = a24 FAILED! expected: a11,a22,a23,a24<br>
 (multiline == true) 'a11\na22\na23\na24'.match(new RegExp('a..$','g')) = a24 FAILED! expected: a11,a22,a23,a24<br>
 </tt><br>
-<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline_as_array.js'>js1_2/regexp/RegExp_multiline_as_array.js</a> failed</b> <br>
- [ <a href='#failure13'>Previous Failure</a> | <a href='#failure15'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_multiline_as_array.js'>js1_2/regexp/RegExp_multiline_as_array.js</a> failed</b> <br>
+ [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 (['$*'] == true) '123\n456'.match(/^4../) = null FAILED! expected: 456<br>
@@ -132,20 +146,42 @@ Failure messages were:<br>
 (['$*'] == true) 'a11\na22\na23\na24'.match(/a..$/g) = a24 FAILED! expected: a11,a22,a23,a24<br>
 (['$*'] == true) 'a11\na22\na23\na24'.match(new RegExp('a..$','g')) = a24 FAILED! expected: a11,a22,a23,a24<br>
 </tt><br>
-<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/beginLine.js'>js1_2/regexp/beginLine.js</a> failed</b> <br>
- [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/beginLine.js'>js1_2/regexp/beginLine.js</a> failed</b> <br>
+ [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 123xyz'.match(new RegExp('^\d+')) = null FAILED! expected: 123<br>
 </tt><br>
-<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/endLine.js'>js1_2/regexp/endLine.js</a> failed</b> <br>
- [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/endLine.js'>js1_2/regexp/endLine.js</a> failed</b> <br>
+ [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 xyz'.match(new RegExp('\d+$')) = null FAILED! expected: 890<br>
 </tt><br>
-<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
- [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-6359.js'>js1_2/regexp/regress-6359.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=6359' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=6359</a><br>
+ [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=6359<br>
+</tt><br>
+<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-9141.js'>js1_2/regexp/regress-9141.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=9141' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=9141</a><br>
+ [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=9141<br>
+</tt><br>
+<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/simple_form.js'>js1_2/regexp/simple_form.js</a> failed</b> <br>
+ [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Executing script: simple_form.js<br>
+As described in Netscape doc "Whats new in JavaScript 1.2" RegExp: simple form<br>
+</tt><br>
+<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
+ [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 'abc'.split(/[a-z]/) = ,,, FAILED! expected: ,,<br>
@@ -153,22 +189,22 @@ Failure messages were:<br>
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 </tt><br>
-<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
- [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
+ [ <a href='#failure22'>Previous Failure</a> | <a href='#failure24'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 new Boolean(false) = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
- [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
+ [ <a href='#failure23'>Previous Failure</a> | <a href='#failure25'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Regression test for Bugzilla bug 99663<br>
 Failure messages were:<br>
 Section 1 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 2 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 3 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 </tt><br>
-<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure24'>Previous Failure</a> | <a href='#failure26'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -176,15 +212,15 @@ BUGNUMBER: 10278<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
- [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
+ [ <a href='#failure25'>Previous Failure</a> | <a href='#failure27'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 script-001 NativeScript<br>
 </tt><br>
-<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure26'>Previous Failure</a> | <a href='#failure28'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -192,90 +228,90 @@ BUGNUMBER: 10278<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
- [ <a href='#failure22'>Previous Failure</a> | <a href='#failure24'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
+ [ <a href='#failure27'>Previous Failure</a> | <a href='#failure29'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
- [ <a href='#failure23'>Previous Failure</a> | <a href='#failure25'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
+ [ <a href='#failure28'>Previous Failure</a> | <a href='#failure30'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
- [ <a href='#failure24'>Previous Failure</a> | <a href='#failure26'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
+ [ <a href='#failure29'>Previous Failure</a> | <a href='#failure31'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
- [ <a href='#failure25'>Previous Failure</a> | <a href='#failure27'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
+ [ <a href='#failure30'>Previous Failure</a> | <a href='#failure32'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
- [ <a href='#failure26'>Previous Failure</a> | <a href='#failure28'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
+ [ <a href='#failure31'>Previous Failure</a> | <a href='#failure33'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 BUGNUMBER: 50447<br>
 STATUS: Test (non-ECMA) Error object properties fileName, lineNumber<br>
 </tt><br>
-<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
- [ <a href='#failure27'>Previous Failure</a> | <a href='#failure29'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
+ [ <a href='#failure32'>Previous Failure</a> | <a href='#failure34'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
- [ <a href='#failure28'>Previous Failure</a> | <a href='#failure30'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
+ [ <a href='#failure33'>Previous Failure</a> | <a href='#failure35'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
- [ <a href='#failure29'>Previous Failure</a> | <a href='#failure31'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
+ [ <a href='#failure34'>Previous Failure</a> | <a href='#failure36'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
- [ <a href='#failure30'>Previous Failure</a> | <a href='#failure32'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
+ [ <a href='#failure35'>Previous Failure</a> | <a href='#failure37'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
- [ <a href='#failure31'>Previous Failure</a> | <a href='#failure33'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
+ [ <a href='#failure36'>Previous Failure</a> | <a href='#failure38'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
- [ <a href='#failure32'>Previous Failure</a> | <a href='#failure34'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
+ [ <a href='#failure37'>Previous Failure</a> | <a href='#failure39'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
- [ <a href='#failure33'>Previous Failure</a> | <a href='#failure35'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
+ [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
- [ <a href='#failure34'>Previous Failure</a> | <a href='#failure36'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
+ [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 BUGNUMBER: 44009<br>
 STATUS: Testing that we don't crash on obj.toSource()<br>
 </tt><br>
-<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
- [ <a href='#failure35'>Previous Failure</a> | <a href='#failure37'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
+ [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Reassignment to a const is NOT an error per ECMA<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 1 of test -<br>
@@ -285,26 +321,26 @@ FAILED!: [reported from test()] Section 3 of test -<br>
 FAILED!: [reported from test()] Expected value '1', Actual value '2'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
- [ <a href='#failure36'>Previous Failure</a> | <a href='#failure38'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
+ [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
- [ <a href='#failure37'>Previous Failure</a> | <a href='#failure39'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
+ [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
- [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
+ [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
- [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
+ [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Don't crash on extraneous arguments to str.match(), etc.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 14 of test -<br>
@@ -354,14 +390,14 @@ FAILED!: [reported from test()] Section 36 of test -<br>
 FAILED!: [reported from test()] Expected value 'SHOULD HAVE FALLEN INTO CATCH-BLOCK!', Actual value 'ABC Zbc'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
- [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
+ [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
- [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure47'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
+ [ <a href='#failure46'>Previous Failure</a> | <a href='#failure48'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Testing scope after changing obj.__proto__<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Step 1:  setting obj.__proto__ = global object<br>
@@ -372,8 +408,8 @@ FAILED!: [reported from test()] Type mismatch, expected type undefined, actual t
 FAILED!: [reported from test()] Expected value 'undefined', Actual value '1'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
- [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure48'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
+ [ <a href='#failure47'>Previous Failure</a> | <a href='#failure49'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: E4X should be enabled even when e4x=1 not specified<br>
 Failure messages were:<br>
 FAILED!: E4X should be enabled even when e4x=1 not specified: XML()<br>
@@ -383,20 +419,20 @@ FAILED!: E4X should be enabled even when e4x=1 not specified: XMLList()<br>
 FAILED!: Expected value 'No error', Actual value 'error: ReferenceError: Can't find variable: XML'<br>
 FAILED!: <br>
 </tt><br>
-<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
- [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure49'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
+ [ <a href='#failure48'>Previous Failure</a> | <a href='#failure50'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
- [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure50'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
+ [ <a href='#failure49'>Previous Failure</a> | <a href='#failure51'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Testcase produced no output!</tt><br>
-<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
- [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure51'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
+ [ <a href='#failure50'>Previous Failure</a> | <a href='#failure52'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -410,17 +446,19 @@ STATUS: See https://bugzilla.mozilla.org/show_bug.cgi?id=304828<br>
 <pre>
 <a name='retest_list'></a>
 <h2>Retest List</h2><br>
-# Retest List, squirrelfish, generated Fri Oct 15 00:29:31 2010.
+# Retest List, squirrelfish, generated Wed Jan 19 13:26:57 2011.
 # Original test base was: All tests.
-# 1119 of 1127 test(s) were completed, 46 failures reported.
+# 1119 of 1127 test(s) were completed, 51 failures reported.
 ecma/TypeConversion/9.3.1-3.js
 ecma_2/Exceptions/function-001.js
+ecma_2/RegExp/regress-001.js
 ecma_3/FunExpr/fe-001.js
 ecma_3/Statements/regress-194364.js
 ecma_3/Unicode/uc-001.js
 js1_2/Objects/toString-001.js
 js1_2/function/Function_object.js
 js1_2/function/function-001-n.js
+js1_2/function/regexparg-1.js
 js1_2/function/tostring-1.js
 js1_2/function/tostring-2.js
 js1_2/operator/equality.js
@@ -429,6 +467,9 @@ js1_2/regexp/RegExp_multiline.js
 js1_2/regexp/RegExp_multiline_as_array.js
 js1_2/regexp/beginLine.js
 js1_2/regexp/endLine.js
+js1_2/regexp/regress-6359.js
+js1_2/regexp/regress-9141.js
+js1_2/regexp/simple_form.js
 js1_2/regexp/string_split.js
 js1_2/version120/boolean-001.js
 js1_2/version120/regress-99663.js
diff --git a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 0c0e997..8b65977 100644
--- a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -51,7 +51,8 @@ namespace WTF {
     // with respect to the original and any other copies.  The underlying m_data is jointly
     // owned by the original instance and all copies.
     template<class T>
-    class CrossThreadRefCounted : public Noncopyable {
+    class CrossThreadRefCounted {
+        WTF_MAKE_NONCOPYABLE(CrossThreadRefCounted);
     public:
         static PassRefPtr<CrossThreadRefCounted<T> > create(T* data)
         {
diff --git a/Source/JavaScriptCore/wtf/DateMath.h b/Source/JavaScriptCore/wtf/DateMath.h
index 8d0d932..41bd4fa 100644
--- a/Source/JavaScriptCore/wtf/DateMath.h
+++ b/Source/JavaScriptCore/wtf/DateMath.h
@@ -44,6 +44,7 @@
 #define DateMath_h
 
 #include <math.h>
+#include <stdint.h>
 #include <string.h>
 #include <time.h>
 #include <wtf/CurrentTime.h>
@@ -120,7 +121,9 @@ double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString)
 
 // Intentionally overridding the default tm of the system.
 // The members of tm differ on various operating systems.
-struct GregorianDateTime : Noncopyable {
+struct GregorianDateTime {
+    WTF_MAKE_NONCOPYABLE(GregorianDateTime);
+public:
     GregorianDateTime()
         : second(0)
         , minute(0)
diff --git a/Source/JavaScriptCore/wtf/Deque.h b/Source/JavaScriptCore/wtf/Deque.h
index 745e0b6..1b16afc 100644
--- a/Source/JavaScriptCore/wtf/Deque.h
+++ b/Source/JavaScriptCore/wtf/Deque.h
@@ -44,7 +44,8 @@ namespace WTF {
     template<typename T> class DequeConstReverseIterator;
 
     template<typename T>
-    class Deque : public FastAllocBase {
+    class Deque {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         typedef DequeIterator<T> iterator;
         typedef DequeConstIterator<T> const_iterator;
diff --git a/Source/JavaScriptCore/wtf/FastAllocBase.h b/Source/JavaScriptCore/wtf/FastAllocBase.h
index bb1825e..e4899ab 100644
--- a/Source/JavaScriptCore/wtf/FastAllocBase.h
+++ b/Source/JavaScriptCore/wtf/FastAllocBase.h
@@ -32,8 +32,8 @@
 // Provides customizable overrides of fastMalloc/fastFree and operator new/delete
 //
 // Provided functionality:
+//    Macro: WTF_MAKE_FAST_ALLOCATED
 //    namespace WTF {
-//        class FastAllocBase;
 //
 //        T*    fastNew<T>();
 //        T*    fastNew<T>(arg);
@@ -48,7 +48,16 @@
 // FastDelete assumes that the underlying
 //
 // Example usage:
-//    class Widget : public FastAllocBase { ... };
+//    class Widget {
+//        WTF_MAKE_FAST_ALLOCATED
+//    ...
+//    };
+//
+//    struct Data {
+//        WTF_MAKE_FAST_ALLOCATED
+//    public:
+//    ...
+//    };
 //
 //    char* charPtr = fastNew<char>();
 //    fastDelete(charPtr);
@@ -83,8 +92,6 @@
 #include "FastMalloc.h"
 #include "TypeTraits.h"
 
-namespace WTF {
-
 #define WTF_MAKE_FAST_ALLOCATED \
 public: \
     void* operator new(size_t, void* p) { return p; } \
@@ -115,11 +122,10 @@ public: \
          ::WTF::fastMallocMatchValidateFree(p, ::WTF::Internal::AllocTypeClassNewArray); \
          ::WTF::fastFree(p); \
     } \
-private:
+private: \
+typedef int ThisIsHereToForceASemicolonAfterThisMacro
 
-class FastAllocBase {
-    WTF_MAKE_FAST_ALLOCATED  
-};
+namespace WTF {
 
     // fastNew / fastDelete
 
@@ -410,7 +416,6 @@ class FastAllocBase {
 
 } // namespace WTF
 
-using WTF::FastAllocBase;
 using WTF::fastDeleteSkippingDestructor;
 
 #endif // FastAllocBase_h
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.cpp b/Source/JavaScriptCore/wtf/FastMalloc.cpp
index 882f10d..ae93c02 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/Source/JavaScriptCore/wtf/FastMalloc.cpp
@@ -453,6 +453,10 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 
 #if HAVE(PTHREAD_MACHDEP_H)
 #include <System/pthread_machdep.h>
+
+#if defined(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0)
+#define WTF_USE_PTHREAD_GETSPECIFIC_DIRECT 1
+#endif
 #endif
 
 #ifndef PRIuS
@@ -463,9 +467,14 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 // call to the function on Mac OS X, and it's used in performance-critical code. So we
 // use a function pointer. But that's not necessarily faster on other platforms, and we had
 // problems with this technique on Windows, so we'll do this only on Mac OS X.
-#if OS(DARWIN) && !defined(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0)
+#if OS(DARWIN)
+#if !USE(PTHREAD_GETSPECIFIC_DIRECT)
 static void* (*pthread_getspecific_function_pointer)(pthread_key_t) = pthread_getspecific;
 #define pthread_getspecific(key) pthread_getspecific_function_pointer(key)
+#else
+#define pthread_getspecific(key) _pthread_getspecific_direct(key)
+#define pthread_setspecific(key, val) _pthread_setspecific_direct(key, (val))
+#endif
 #endif
 
 #define DEFINE_VARIABLE(type, name, value, meaning) \
@@ -2519,25 +2528,30 @@ static __thread TCMalloc_ThreadCache *threadlocal_heap;
 // Therefore, we use TSD keys only after tsd_inited is set to true.
 // Until then, we use a slow path to get the heap object.
 static bool tsd_inited = false;
+#if USE(PTHREAD_GETSPECIFIC_DIRECT)
+static const pthread_key_t heap_key = __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0;
+#else
 static pthread_key_t heap_key;
+#endif
 #if OS(WINDOWS)
 DWORD tlsIndex = TLS_OUT_OF_INDEXES;
 #endif
 
 static ALWAYS_INLINE void setThreadHeap(TCMalloc_ThreadCache* heap)
 {
+#if USE(PTHREAD_GETSPECIFIC_DIRECT)
+    // Can't have two libraries both doing this in the same process,
+    // so check and make this crash right away.
+    if (pthread_getspecific(heap_key))
+        CRASH();
+#endif
+
     // Still do pthread_setspecific even if there's an alternate form
     // of thread-local storage in use, to benefit from the delete callback.
     pthread_setspecific(heap_key, heap);
 
 #if OS(WINDOWS)
     TlsSetValue(tlsIndex, heap);
-#elif defined(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0)
-    // Can't have two libraries both doing this in the same process,
-    // so check and make this crash right away.
-    if (_pthread_getspecific_direct(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0))
-        CRASH();
-    _pthread_setspecific_direct(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0, heap);
 #endif
 }
 
@@ -3049,8 +3063,6 @@ inline TCMalloc_ThreadCache* TCMalloc_ThreadCache::GetThreadHeap() {
     return threadlocal_heap;
 #elif OS(WINDOWS)
     return static_cast<TCMalloc_ThreadCache*>(TlsGetValue(tlsIndex));
-#elif defined(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0)
-    return static_cast<TCMalloc_ThreadCache*>(_pthread_getspecific_direct(__PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0));
 #else
     return static_cast<TCMalloc_ThreadCache*>(pthread_getspecific(heap_key));
 #endif
@@ -3078,7 +3090,11 @@ inline TCMalloc_ThreadCache* TCMalloc_ThreadCache::GetCacheIfPresent() {
 
 void TCMalloc_ThreadCache::InitTSD() {
   ASSERT(!tsd_inited);
+#if USE(PTHREAD_GETSPECIFIC_DIRECT)
+  pthread_key_init_np(heap_key, DestroyThreadCache);
+#else
   pthread_key_create(&heap_key, DestroyThreadCache);
+#endif
 #if OS(WINDOWS)
   tlsIndex = TlsAlloc();
 #endif
diff --git a/Source/JavaScriptCore/wtf/HashCountedSet.h b/Source/JavaScriptCore/wtf/HashCountedSet.h
index 4ed75c5..b97d8c8 100644
--- a/Source/JavaScriptCore/wtf/HashCountedSet.h
+++ b/Source/JavaScriptCore/wtf/HashCountedSet.h
@@ -22,14 +22,14 @@
 #define WTF_HashCountedSet_h
 
 #include "Assertions.h"
-#include "FastAllocBase.h"
 #include "HashMap.h"
 #include "Vector.h"
 
 namespace WTF {
 
     template<typename Value, typename HashFunctions = typename DefaultHash<Value>::Hash,
-        typename Traits = HashTraits<Value> > class HashCountedSet : public FastAllocBase {
+        typename Traits = HashTraits<Value> > class HashCountedSet {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef HashMap<Value, unsigned, HashFunctions, Traits> ImplType;
     public:
diff --git a/Source/JavaScriptCore/wtf/HashMap.h b/Source/JavaScriptCore/wtf/HashMap.h
index 09094d1..7731546 100644
--- a/Source/JavaScriptCore/wtf/HashMap.h
+++ b/Source/JavaScriptCore/wtf/HashMap.h
@@ -29,7 +29,8 @@ namespace WTF {
 
     template<typename KeyArg, typename MappedArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
         typename KeyTraitsArg = HashTraits<KeyArg>, typename MappedTraitsArg = HashTraits<MappedArg> >
-    class HashMap : public FastAllocBase {
+    class HashMap {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/Source/JavaScriptCore/wtf/HashSet.h b/Source/JavaScriptCore/wtf/HashSet.h
index 66639e4..be6b93d 100644
--- a/Source/JavaScriptCore/wtf/HashSet.h
+++ b/Source/JavaScriptCore/wtf/HashSet.h
@@ -35,7 +35,8 @@ namespace WTF {
     template<typename T> struct IdentityExtractor;
 
     template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash,
-        typename TraitsArg = HashTraits<ValueArg> > class HashSet : public FastAllocBase {
+        typename TraitsArg = HashTraits<ValueArg> > class HashSet {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef HashArg HashFunctions;
         typedef TraitsArg ValueTraits;
diff --git a/Source/JavaScriptCore/wtf/ListHashSet.h b/Source/JavaScriptCore/wtf/ListHashSet.h
index e14ac45..e916ef2 100644
--- a/Source/JavaScriptCore/wtf/ListHashSet.h
+++ b/Source/JavaScriptCore/wtf/ListHashSet.h
@@ -52,7 +52,8 @@ namespace WTF {
     template<typename ValueArg, size_t inlineCapacity> struct ListHashSetNodeAllocator;
     template<typename ValueArg, size_t inlineCapacity, typename HashArg> struct ListHashSetNodeHashFunctions;
 
-    template<typename ValueArg, size_t inlineCapacity = 256, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet : public FastAllocBase {
+    template<typename ValueArg, size_t inlineCapacity = 256, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef ListHashSetNode<ValueArg, inlineCapacity> Node;
         typedef ListHashSetNodeAllocator<ValueArg, inlineCapacity> NodeAllocator;
diff --git a/Source/JavaScriptCore/wtf/Locker.h b/Source/JavaScriptCore/wtf/Locker.h
index 41813d3..c465b99 100644
--- a/Source/JavaScriptCore/wtf/Locker.h
+++ b/Source/JavaScriptCore/wtf/Locker.h
@@ -32,7 +32,8 @@
 
 namespace WTF {
 
-template <typename T> class Locker : public Noncopyable {
+template <typename T> class Locker {
+    WTF_MAKE_NONCOPYABLE(Locker);
 public:
     Locker(T& lockable) : m_lockable(lockable) { m_lockable.lock(); }
     ~Locker() { m_lockable.unlock(); }
diff --git a/Source/JavaScriptCore/wtf/MessageQueue.h b/Source/JavaScriptCore/wtf/MessageQueue.h
index 14100c9..7c18a0c 100644
--- a/Source/JavaScriptCore/wtf/MessageQueue.h
+++ b/Source/JavaScriptCore/wtf/MessageQueue.h
@@ -48,7 +48,8 @@ namespace WTF {
     // when messages are fetched from the queue.
     // Essentially, MessageQueue acts as a queue of OwnPtr<DataType>.
     template<typename DataType>
-    class MessageQueue : public Noncopyable {
+    class MessageQueue {
+        WTF_MAKE_NONCOPYABLE(MessageQueue);
     public:
         MessageQueue() : m_killed(false) { }
         ~MessageQueue();
diff --git a/Source/JavaScriptCore/wtf/Noncopyable.h b/Source/JavaScriptCore/wtf/Noncopyable.h
index 285ed2e..cc6bc55 100644
--- a/Source/JavaScriptCore/wtf/Noncopyable.h
+++ b/Source/JavaScriptCore/wtf/Noncopyable.h
@@ -41,23 +41,4 @@
             ClassName& operator=(const ClassName&)
 #endif
 
-// We don't want argument-dependent lookup to pull in everything from the WTF
-// namespace when you use Noncopyable, so put it in its own namespace.
-
-#include "FastAllocBase.h"
-
-namespace WTFNoncopyable {
-
-    class Noncopyable : public FastAllocBase {
-        Noncopyable(const Noncopyable&);
-        Noncopyable& operator=(const Noncopyable&);
-    protected:
-        Noncopyable() { }
-        ~Noncopyable() { }
-    };
-
-} // namespace WTFNoncopyable
-
-using WTFNoncopyable::Noncopyable;
-
 #endif // WTF_Noncopyable_h
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtr.h b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
index 643b90b..f838a7e 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -24,6 +24,7 @@
 #include "Assertions.h"
 #include "Noncopyable.h"
 #include "NullPtr.h"
+#include "OwnPtrCommon.h"
 #include "OwnArrayPtrCommon.h"
 #include <algorithm>
 
@@ -35,7 +36,7 @@ namespace WTF {
 template<typename T> class PassOwnArrayPtr;
 template<typename T> PassOwnArrayPtr<T> adoptArrayPtr(T*);
 
-template <typename T> class OwnArrayPtr : public Noncopyable {
+template <typename T> class OwnArrayPtr {
 public:
     typedef T* PtrType;
 
diff --git a/Source/JavaScriptCore/wtf/OwnFastMallocPtr.h b/Source/JavaScriptCore/wtf/OwnFastMallocPtr.h
index 8b6cbf4..9d4841a 100644
--- a/Source/JavaScriptCore/wtf/OwnFastMallocPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -23,11 +23,11 @@
 #define OwnFastMallocPtr_h
 
 #include "FastMalloc.h"
-#include "Noncopyable.h"
 
 namespace WTF {
 
-    template<class T> class OwnFastMallocPtr : public Noncopyable {
+    template<class T> class OwnFastMallocPtr {
+        WTF_MAKE_NONCOPYABLE(OwnFastMallocPtr);
     public:
         explicit OwnFastMallocPtr(T* ptr) : m_ptr(ptr)
         {
diff --git a/Source/JavaScriptCore/wtf/OwnPtr.h b/Source/JavaScriptCore/wtf/OwnPtr.h
index cdc277c..fb59432 100644
--- a/Source/JavaScriptCore/wtf/OwnPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnPtr.h
@@ -22,7 +22,6 @@
 #define WTF_OwnPtr_h
 
 #include "Assertions.h"
-#include "Noncopyable.h"
 #include "NullPtr.h"
 #include "OwnPtrCommon.h"
 #include "TypeTraits.h"
@@ -39,7 +38,7 @@ namespace WTF {
     template<typename T> class PassOwnPtr;
     template<typename T> PassOwnPtr<T> adoptPtr(T*);
 
-    template<typename T> class OwnPtr : public Noncopyable {
+    template<typename T> class OwnPtr {
     public:
         typedef typename RemovePointer<T>::Type ValueType;
         typedef ValueType* PtrType;
diff --git a/Source/JavaScriptCore/wtf/RefCounted.h b/Source/JavaScriptCore/wtf/RefCounted.h
index 8d8b302..da178b2 100644
--- a/Source/JavaScriptCore/wtf/RefCounted.h
+++ b/Source/JavaScriptCore/wtf/RefCounted.h
@@ -22,6 +22,7 @@
 #define RefCounted_h
 
 #include "Assertions.h"
+#include "FastAllocBase.h"
 #include "Noncopyable.h"
 
 namespace WTF {
@@ -131,7 +132,8 @@ inline void adopted(RefCountedBase* object)
 
 #endif
 
-template<typename T> class RefCounted : public RefCountedBase, public Noncopyable {
+template<typename T> class RefCounted : public RefCountedBase {
+    WTF_MAKE_NONCOPYABLE(RefCounted); WTF_MAKE_FAST_ALLOCATED;
 public:
     void deref()
     {
@@ -140,6 +142,7 @@ public:
     }
 
 protected:
+    RefCounted() { }
     ~RefCounted()
     {
     }
diff --git a/Source/JavaScriptCore/wtf/RefPtr.h b/Source/JavaScriptCore/wtf/RefPtr.h
index d57f88a..353bd35 100644
--- a/Source/JavaScriptCore/wtf/RefPtr.h
+++ b/Source/JavaScriptCore/wtf/RefPtr.h
@@ -36,7 +36,8 @@ namespace WTF {
 
     enum HashTableDeletedValueType { HashTableDeletedValue };
 
-    template<typename T> class RefPtr : public FastAllocBase {
+    template<typename T> class RefPtr {
+        WTF_MAKE_FAST_ALLOCATED;
     public:
         ALWAYS_INLINE RefPtr() : m_ptr(0) { }
         ALWAYS_INLINE RefPtr(T* ptr) : m_ptr(ptr) { refIfNotNull(ptr); }
diff --git a/Source/JavaScriptCore/wtf/RefPtrHashMap.h b/Source/JavaScriptCore/wtf/RefPtrHashMap.h
index b9e7eea..dbeabfa 100644
--- a/Source/JavaScriptCore/wtf/RefPtrHashMap.h
+++ b/Source/JavaScriptCore/wtf/RefPtrHashMap.h
@@ -45,7 +45,8 @@ namespace WTF {
     };
 
     template<typename T, typename MappedArg, typename HashArg, typename KeyTraitsArg, typename MappedTraitsArg>
-    class HashMap<RefPtr<T>, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> : public FastAllocBase {
+    class HashMap<RefPtr<T>, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/Source/JavaScriptCore/wtf/StackBounds.cpp b/Source/JavaScriptCore/wtf/StackBounds.cpp
index be8ce84..41e0d60 100644
--- a/Source/JavaScriptCore/wtf/StackBounds.cpp
+++ b/Source/JavaScriptCore/wtf/StackBounds.cpp
@@ -60,12 +60,12 @@ namespace WTF {
 // Bug 26276 - Need a mechanism to determine stack extent
 //
 // These platforms should now be working correctly:
-//     DARWIN, QNX, UNIX
+//     DARWIN, QNX, UNIX, SYMBIAN
 // These platforms are not:
-//     WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+//     WINDOWS, SOLARIS, OPENBSD, HAIKU, WINCE
 //
 // FIXME: remove this! - this code unsafely guesses at stack sizes!
-#if OS(WINDOWS) || OS(SOLARIS) || OS(OPENBSD) || OS(SYMBIAN) || OS(HAIKU)
+#if OS(WINDOWS) || OS(SOLARIS) || OS(OPENBSD) || OS(HAIKU)
 // Based on the current limit used by the JSC parser, guess the stack size.
 static const ptrdiff_t estimatedStackSize = 128 * sizeof(void*) * 1024;
 // This method assumes the stack is growing downwards.
@@ -139,7 +139,7 @@ void StackBounds::initialize()
     RThread thread;
     thread.StackInfo(info);
     m_origin = (void*)info.iBase;
-    m_bound = estimateStackBound(m_origin);
+    m_bound = (void*)info.iLimit;
 }
 
 #elif OS(HAIKU)
diff --git a/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h b/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
index 3af87a8..ed1ba2c 100644
--- a/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
+++ b/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
@@ -31,14 +31,14 @@
 #ifndef ThreadIdentifierDataPthreads_h
 #define ThreadIdentifierDataPthreads_h
 
-#include <wtf/Noncopyable.h>
 #include <wtf/Threading.h>
 
 namespace WTF {
 
 // Holds ThreadIdentifier in the thread-specific storage and employs pthreads-specific 2-pass destruction to reliably remove
 // ThreadIdentifier from threadMap. It assumes regular ThreadSpecific types don't use multiple-pass destruction.
-class ThreadIdentifierData : public Noncopyable {
+class ThreadIdentifierData {
+    WTF_MAKE_NONCOPYABLE(ThreadIdentifierData);
 public:
     ~ThreadIdentifierData();
 
diff --git a/Source/JavaScriptCore/wtf/ThreadSafeShared.h b/Source/JavaScriptCore/wtf/ThreadSafeShared.h
index 33c6612..a6a1cf2 100644
--- a/Source/JavaScriptCore/wtf/ThreadSafeShared.h
+++ b/Source/JavaScriptCore/wtf/ThreadSafeShared.h
@@ -62,12 +62,12 @@
 #include "Platform.h"
 
 #include <wtf/Atomics.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace WTF {
 
-class ThreadSafeSharedBase : public Noncopyable {
+class ThreadSafeSharedBase {
+    WTF_MAKE_NONCOPYABLE(ThreadSafeSharedBase); WTF_MAKE_FAST_ALLOCATED;
 public:
     ThreadSafeSharedBase(int initialRefCount = 1)
         : m_refCount(initialRefCount)
diff --git a/Source/JavaScriptCore/wtf/ThreadSpecific.h b/Source/JavaScriptCore/wtf/ThreadSpecific.h
index 93ed466..fa9a393 100644
--- a/Source/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/Source/JavaScriptCore/wtf/ThreadSpecific.h
@@ -61,7 +61,8 @@ namespace WTF {
 void ThreadSpecificThreadExit();
 #endif
 
-template<typename T> class ThreadSpecific : public Noncopyable {
+template<typename T> class ThreadSpecific {
+    WTF_MAKE_NONCOPYABLE(ThreadSpecific);
 public:
     ThreadSpecific();
     T* operator->();
@@ -84,7 +85,9 @@ private:
     void static destroy(void* ptr);
 
 #if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(GTK) || OS(WINDOWS)
-    struct Data : Noncopyable {
+    struct Data {
+        WTF_MAKE_NONCOPYABLE(Data);
+    public:
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 #if PLATFORM(QT)
         ~Data() { owner->destroy(this); }
diff --git a/Source/JavaScriptCore/wtf/ThreadSpecificWin.cpp b/Source/JavaScriptCore/wtf/ThreadSpecificWin.cpp
index f2c0cad..d72996a 100644
--- a/Source/JavaScriptCore/wtf/ThreadSpecificWin.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadSpecificWin.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 
 #include "ThreadSpecific.h"
-#include <wtf/Noncopyable.h>
 
 #if USE(PTHREADS)
 #error This file should not be compiled by ports that do not use Windows native ThreadSpecific implementation.
diff --git a/Source/JavaScriptCore/wtf/Threading.cpp b/Source/JavaScriptCore/wtf/Threading.cpp
index 49de59e..f2e0565 100644
--- a/Source/JavaScriptCore/wtf/Threading.cpp
+++ b/Source/JavaScriptCore/wtf/Threading.cpp
@@ -30,7 +30,9 @@
 
 namespace WTF {
 
-struct NewThreadContext : FastAllocBase {
+struct NewThreadContext {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     NewThreadContext(ThreadFunction entryPoint, void* data, const char* name)
         : entryPoint(entryPoint)
         , data(data)
diff --git a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
index c11a6cb..809c3e2 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
+++ b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
@@ -34,6 +34,7 @@
 #include "Platform.h"
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/Locker.h>
 #include <wtf/Noncopyable.h>
 
@@ -96,7 +97,8 @@ typedef void* PlatformReadWriteLock;
 typedef void* PlatformCondition;
 #endif
     
-class Mutex : public Noncopyable {
+class Mutex {
+    WTF_MAKE_NONCOPYABLE(Mutex); WTF_MAKE_FAST_ALLOCATED;
 public:
     Mutex();
     ~Mutex();
@@ -113,7 +115,8 @@ private:
 
 typedef Locker<Mutex> MutexLocker;
 
-class ReadWriteLock : public Noncopyable {
+class ReadWriteLock {
+    WTF_MAKE_NONCOPYABLE(ReadWriteLock);
 public:
     ReadWriteLock();
     ~ReadWriteLock();
@@ -130,7 +133,8 @@ private:
     PlatformReadWriteLock m_readWriteLock;
 };
 
-class ThreadCondition : public Noncopyable {
+class ThreadCondition {
+    WTF_MAKE_NONCOPYABLE(ThreadCondition);
 public:
     ThreadCondition();
     ~ThreadCondition();
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index f73793f..6d8dd4c 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -277,7 +277,8 @@ namespace WTF {
     };
 
     template<typename T>
-    class VectorBufferBase : public Noncopyable {
+    class VectorBufferBase {
+        WTF_MAKE_NONCOPYABLE(VectorBufferBase);
     public:
         void allocateBuffer(size_t newCapacity)
         {
@@ -488,7 +489,8 @@ namespace WTF {
     };
 
     template<typename T, size_t inlineCapacity = 0>
-    class Vector : public FastAllocBase {
+    class Vector {
+        WTF_MAKE_FAST_ALLOCATED;
     private:
         typedef VectorBuffer<T, inlineCapacity> Buffer;
         typedef VectorTypeOperations<T> TypeOperations;
diff --git a/Source/JavaScriptCore/wtf/WTFThreadData.h b/Source/JavaScriptCore/wtf/WTFThreadData.h
index 52c267a..243aa91 100644
--- a/Source/JavaScriptCore/wtf/WTFThreadData.h
+++ b/Source/JavaScriptCore/wtf/WTFThreadData.h
@@ -52,7 +52,8 @@ namespace JSC {
 
 typedef HashMap<const char*, RefPtr<StringImpl>, PtrHash<const char*> > LiteralIdentifierTable;
 
-class IdentifierTable : public FastAllocBase {
+class IdentifierTable {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     ~IdentifierTable();
 
@@ -85,7 +86,8 @@ class AtomicStringTable;
 
 typedef void (*AtomicStringTableDestructor)(AtomicStringTable*);
 
-class WTFThreadData : public Noncopyable {
+class WTFThreadData {
+    WTF_MAKE_NONCOPYABLE(WTFThreadData);
 public:
     WTFThreadData();
     ~WTFThreadData();
diff --git a/Source/JavaScriptCore/wtf/dtoa.cpp b/Source/JavaScriptCore/wtf/dtoa.cpp
index c89c036..b5b1261 100644
--- a/Source/JavaScriptCore/wtf/dtoa.cpp
+++ b/Source/JavaScriptCore/wtf/dtoa.cpp
@@ -414,7 +414,10 @@ static void mult(BigInt& aRef, const BigInt& bRef)
     aRef = c;
 }
 
-struct P5Node : Noncopyable {
+struct P5Node {
+    WTF_MAKE_NONCOPYABLE(P5Node); WTF_MAKE_FAST_ALLOCATED;
+public:
+    P5Node() { }
     BigInt val;
     P5Node* next;
 };
diff --git a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
index cec3e43..4136f28 100644
--- a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
+++ b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -41,7 +41,8 @@ template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
 template<> void freeOwnedGPtr<GDir>(GDir*);
 template<> void freeOwnedGPtr<GFile>(GFile*);
 
-template <typename T> class GOwnPtr : public Noncopyable {
+template <typename T> class GOwnPtr {
+    WTF_MAKE_NONCOPYABLE(GOwnPtr);
 public:
     explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
     ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
diff --git a/Source/JavaScriptCore/wtf/text/StringBuffer.h b/Source/JavaScriptCore/wtf/text/StringBuffer.h
index a546bf3..e73d38e 100644
--- a/Source/JavaScriptCore/wtf/text/StringBuffer.h
+++ b/Source/JavaScriptCore/wtf/text/StringBuffer.h
@@ -30,13 +30,13 @@
 #define StringBuffer_h
 
 #include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/unicode/Unicode.h>
 #include <limits>
 
 namespace WTF {
 
-class StringBuffer : public Noncopyable {
+class StringBuffer {
+    WTF_MAKE_NONCOPYABLE(StringBuffer);
 public:
     explicit StringBuffer(unsigned length)
         : m_length(length)
diff --git a/Source/JavaScriptCore/wtf/text/StringImplBase.h b/Source/JavaScriptCore/wtf/text/StringImplBase.h
index 6567672..26bc1d9 100644
--- a/Source/JavaScriptCore/wtf/text/StringImplBase.h
+++ b/Source/JavaScriptCore/wtf/text/StringImplBase.h
@@ -26,12 +26,12 @@
 #ifndef StringImplBase_h
 #define StringImplBase_h
 
-#include <wtf/Noncopyable.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WTF {
 
-class StringImplBase : public Noncopyable {
+class StringImplBase {
+    WTF_MAKE_NONCOPYABLE(StringImplBase); WTF_MAKE_FAST_ALLOCATED;
 public:
     bool isStringImpl() { return (m_refCountAndFlags & s_refCountInvalidForStringImpl) != s_refCountInvalidForStringImpl; }
     unsigned length() const { return m_length; }
@@ -45,9 +45,6 @@ protected:
         BufferShared,
     };
 
-    using Noncopyable::operator new;
-    void* operator new(size_t, void* inPlace) { ASSERT(inPlace); return inPlace; }
-
     // For SmallStringStorage, which allocates an array and uses an in-place new.
     StringImplBase() { }
 
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.cpp b/Source/JavaScriptCore/wtf/text/WTFString.cpp
index 6bb74f6..4b6ff75 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/Source/JavaScriptCore/wtf/text/WTFString.cpp
@@ -612,7 +612,7 @@ void String::split(const String& separator, bool allowEmptyEntries, Vector<Strin
 
 void String::split(const String& separator, Vector<String>& result) const
 {
-    return split(separator, false, result);
+    split(separator, false, result);
 }
 
 void String::split(UChar separator, bool allowEmptyEntries, Vector<String>& result) const
@@ -632,7 +632,7 @@ void String::split(UChar separator, bool allowEmptyEntries, Vector<String>& resu
 
 void String::split(UChar separator, Vector<String>& result) const
 {
-    return split(String(&separator, 1), false, result);
+    split(String(&separator, 1), false, result);
 }
 
 CString String::ascii() const
diff --git a/Source/JavaScriptCore/wtf/unicode/Collator.h b/Source/JavaScriptCore/wtf/unicode/Collator.h
index fe6a809..00ab16e 100644
--- a/Source/JavaScriptCore/wtf/unicode/Collator.h
+++ b/Source/JavaScriptCore/wtf/unicode/Collator.h
@@ -29,6 +29,7 @@
 #ifndef WTF_Collator_h
 #define WTF_Collator_h
 
+#include <wtf/FastAllocBase.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
@@ -39,7 +40,8 @@ struct UCollator;
 
 namespace WTF {
 
-    class Collator : public Noncopyable {
+    class Collator {
+        WTF_MAKE_NONCOPYABLE(Collator); WTF_MAKE_FAST_ALLOCATED;
     public:
         enum Result { Equal = 0, Greater = 1, Less = -1 };
 
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.h b/Source/JavaScriptCore/yarr/YarrInterpreter.h
index be703a9..eea5266 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.h
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.h
@@ -299,7 +299,8 @@ struct ByteTerm {
     }
 };
 
-class ByteDisjunction : public FastAllocBase {
+class ByteDisjunction {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
         : m_numSubpatterns(numSubpatterns)
@@ -312,7 +313,9 @@ public:
     unsigned m_frameSize;
 };
 
-struct BytecodePattern : FastAllocBase {
+struct BytecodePattern {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     BytecodePattern(PassOwnPtr<ByteDisjunction> body, Vector<ByteDisjunction*> allParenthesesInfo, YarrPattern& pattern, BumpPointerAllocator* allocator)
         : m_body(body)
         , m_ignoreCase(pattern.m_ignoreCase)
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index ae59cba..9d13d45 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -606,9 +606,9 @@ class YarrGenerator : private MacroAssembler {
                 m_nextBacktrack->setLabel(label);
         }
 
-        void copyBacktrackToLabel(BacktrackDestination& rhs)
+        void propagateBacktrackToLabel(const BacktrackDestination& rhs)
         {
-            if (rhs.m_backtrackToLabel)
+            if (!m_backtrackToLabel && rhs.m_backtrackToLabel)
                 m_backtrackToLabel = rhs.m_backtrackToLabel;
         }
 
@@ -618,6 +618,11 @@ class YarrGenerator : private MacroAssembler {
                 m_backtrackToLabel = backtrackToLabel;
         }
 
+        bool hasBacktrackToLabel()
+        {
+            return m_backtrackToLabel;
+        }
+
         void setBacktrackJumpList(JumpList* jumpList)
         {
             m_backtrackType = BacktrackJumpList;
@@ -634,8 +639,10 @@ class YarrGenerator : private MacroAssembler {
             if (m_subDataLabelPtr) {
                 *m_subDataLabelPtr = dp;
                 m_subDataLabelPtr = 0;
-            } else
+            } else {
+                ASSERT(!hasDataLabel());
                 m_dataLabelPtr = dp;
+            }
         }
 
         void clearSubDataLabelPtr()
@@ -748,6 +755,12 @@ class YarrGenerator : private MacroAssembler {
             return false;
         }
 
+        void linkBacktrackToLabel(Label backtrackLabel)
+        {
+            if (m_backtrackToLabel)
+                *m_backtrackToLabel = backtrackLabel;
+        }
+
         void linkAlternativeBacktracks(YarrGenerator* generator, bool nextIteration = false)
         {
             Label hereLabel = generator->label();
@@ -919,24 +932,19 @@ class YarrGenerator : private MacroAssembler {
             return m_backtrack.plantJumpToBacktrackIfExists(generator);
         }
 
-        bool linkDataLabelToBacktrackIfExists(YarrGenerator* generator, DataLabelPtr dataLabel)
+        void linkDataLabelToBacktrackIfExists(YarrGenerator* generator, DataLabelPtr dataLabel)
         {
             // If we have a stack offset backtrack destination, use it directly
             if (m_backtrack.isStackOffset()) {
                 generator->m_expressionState.addIndirectJumpEntry(m_backtrack.getStackOffset(), dataLabel);
                 m_backtrack.clearSubDataLabelPtr();
             } else {
-                // Otherwise set the data label (which may be linked)
-                setBacktrackDataLabel(dataLabel);
-
-                if ((m_backtrack.isLabel()) && (m_backtrack.hasDataLabel())) {
-                    generator->m_expressionState.m_backtrackRecords.append(AlternativeBacktrackRecord(m_backtrack.getDataLabel(), m_backtrack.getLabel()));
-                    m_backtrack.clearDataLabel();
-                    return true;
-                }
+                // If we have a backtrack label, connect the datalabel to it directly.
+                if (m_backtrack.isLabel())
+                    generator->m_expressionState.m_backtrackRecords.append(AlternativeBacktrackRecord(dataLabel, m_backtrack.getLabel()));
+                else
+                    setBacktrackDataLabel(dataLabel);
             }
-
-            return false;
         }
 
         void addBacktrackJump(Jump jump)
@@ -990,6 +998,10 @@ class YarrGenerator : private MacroAssembler {
         {
             if (doJump)
                 m_backtrack.jumpToBacktrack(generator, backtrack.getBacktrackJumps());
+
+            if (m_backtrack.isLabel() && backtrack.hasBacktrackToLabel())
+                backtrack.linkBacktrackToLabel(m_backtrack.getLabel());
+
             if (backtrack.hasDestination()) {
                 if (m_backtrack.hasDataLabel())
                     generator->m_expressionState.addDataLabelToNextIteration(m_backtrack.getDataLabel());
@@ -1007,7 +1019,6 @@ class YarrGenerator : private MacroAssembler {
         BacktrackDestination m_backtrack;
         BacktrackDestination* m_linkedBacktrack;
         ParenthesesTail* m_parenthesesTail;
-
     };
 
     struct ParenthesesTail {
@@ -1638,13 +1649,19 @@ class YarrGenerator : private MacroAssembler {
             m_expressionState.incrementParenNestingLevel();
 
             TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            
+            // Use the current paren Tail to connect the nested parentheses.
+            parenthesesState.setParenthesesTail(state.getParenthesesTail());
+
             generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
             // this expects that any backtracks back out of the parentheses will be in the
             // parenthesesState's m_backTrackJumps vector, and that if they need backtracking
             // they will have set an entry point on the parenthesesState's m_backtrackLabel.
             BacktrackDestination& parenthesesBacktrack = parenthesesState.getBacktrackDestination();
+            BacktrackDestination& stateBacktrack = state.getBacktrackDestination();
+
             state.propagateBacktrackingFrom(this, parenthesesBacktrack);
-            state.getBacktrackDestination().copyBacktrackToLabel(parenthesesBacktrack);
+            stateBacktrack.propagateBacktrackToLabel(parenthesesBacktrack);
 
             m_expressionState.decrementParenNestingLevel();
         } else {
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.h b/Source/JavaScriptCore/yarr/YarrPattern.h
index 2172dda..d80f692 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.h
+++ b/Source/JavaScriptCore/yarr/YarrPattern.h
@@ -63,7 +63,9 @@ private:
     }
 };
 
-struct CharacterClass : FastAllocBase {
+struct CharacterClass {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     // All CharacterClass instances have to have the full set of matches and ranges,
     // they may have an optional table for faster lookups (which must match the
     // specified matches and ranges)
@@ -204,7 +206,9 @@ struct PatternTerm {
     }
 };
 
-struct PatternAlternative : FastAllocBase {
+struct PatternAlternative {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     PatternAlternative(PatternDisjunction* disjunction)
         : m_parent(disjunction)
         , m_onceThrough(false)
@@ -245,7 +249,9 @@ struct PatternAlternative : FastAllocBase {
     bool m_containsBOL : 1;
 };
 
-struct PatternDisjunction : FastAllocBase {
+struct PatternDisjunction {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     PatternDisjunction(PatternAlternative* parent = 0)
         : m_parent(parent)
         , m_hasFixedSize(false)